For years, we were told that a good password needs a capital letter, a number and a symbol. The advice sounded sensible, but it did less than people hoped. This guide, part of our password basics series, explains what complexity does and does not do.
What password complexity means
Complexity means the mix of character types in a password: lowercase letters, capitals, numbers and symbols. A complexity rule is the familiar message saying your password must contain at least one of each.
The idea is simple. The more kinds of characters a password could contain, the more possibilities an attacker has to try, which is what password strength measures. That is true, but only if each character is chosen at random.
The maths: length beats symbols
Compare what each change does to an 8-character lowercase password:
- Using the whole keyboard (94 characters instead of 26) multiplies the possibilities by about 29,000.
- Adding four more lowercase letters multiplies them by about 457,000.
Four extra letters beat every symbol on the keyboard, and they are easier to type.
To be fair to symbols, a random 12-character password from the full keyboard is stronger than a random 12-character password in lowercase. Complexity is not useless. It is just a weaker lever than length, and it is the one that causes the most trouble.
Why complexity rules backfire
Rules do not change how people think. Faced with a demand for a capital, a number and a symbol, most of us do the same few things:
- Start with a real word.
- Capitalize the first letter.
- Swap letters for lookalikes, such as
ato@andoto0. - Add a number or
!at the end.
The result, something like P@ssw0rd1!, is a classic weak pattern. It passes every rule and is still among the first things an attacker tries. Their tools apply the same swaps automatically to every word in the dictionary. Our guide to passwords versus passphrases shows a better approach.
Complexity also makes passwords harder to remember, which pushes people to reuse them or write them on a sticky note by the screen.
What the experts say now
The current NIST guidelines are blunt: services "SHALL NOT impose other composition rules" such as requiring mixtures of character types. The same document says services should check new passwords against a blocklist of known common and compromised ones instead. That catches P@ssw0rd1! while leaving you free to use a long passphrase.
You will still meet old rules for years, so here is how to deal with them.
What to do in practice
- Use a password manager's generator. Set it to 20 characters with all character types on. It will pass nearly any rule, and each character is truly random.
- For passwords you must remember, use random words. Add a number or symbol only if the site insists. A separator between words works well.
- If a site forbids symbols, turn them off in the generator and increase the length.