The Password Rules Were Wrong: Why Length Beats Complexity
Symbols, numbers and a new password every few months: the rules came from one 2003 document, and its author later said he regretted them.
Every time a website demands a capital letter, a number and a symbol, it is following advice written in 2003 by one man. In 2017 he told the Wall Street Journal: “Much of what I did I now regret.”
Where the rules came from
Bill Burr was a manager at the US National Institute of Standards and Technology (NIST). His short appendix on passwords suggested mixing upper and lower case, digits and special characters, and changing passwords regularly. Banks, universities and government agencies copied it, and it shaped login screens for well over a decade.
The idea was reasonable. Many people chose passwords like “password123”, and adding variety should make them harder to guess.
Why it backfired
People are not random. Asked for a capital, a number and a symbol, people tend to fall into predictable patterns, such as a capital at the start, a number and an exclamation mark at the end, or an “@” instead of an “a”. Password-guessing tools are built to try those habits first.
Forced changes made it worse. When researchers at the University of North Carolina studied more than 7,700 accounts with compulsory expiry, they found that new passwords were often easy to guess from the old ones, because people tend to make small, predictable changes. The authors questioned whether expiry was worth keeping at all.
What the experts say now
NIST rewrote its guidance in 2017 and tightened it again in its latest revision. It now says websites must not impose rules on mixing character types, must not force regular changes, and must check new passwords against lists of known leaked ones. A password used on its own must be at least 15 characters, and sites should allow at least 64.
The UK’s National Cyber Security Centre agrees. It advises organisations not to force regular expiry, and suggests passwords made of three random words.
Why length wins
Each extra character multiplies the number of possibilities. Fifteen random lowercase letters allow about 275,000 times as many combinations as eight random characters drawn from the whole keyboard. The catch is the word random: a famous phrase or a line from a song is far easier to guess than its length suggests.
The takeaway
Make passwords long rather than clever, use a different one for every important account, and only change one when you have reason to think it has leaked. A string of unrelated words you can remember beats a short jumble you have to write on a sticky note.
Sources & further reading
- 01Burr, W. (2003). Password guidance for NIST, later Appendix A of Special Publication 800-63, Electronic Authentication Guideline. National Institute of Standards and Technology.
- 02The Wall Street Journal (August 2017). Interview with Bill Burr on the 2003 password rules.
- 03NIST (2025). Special Publication 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management.
- 04Zhang, Y., Monrose, F. & Reiter, M. K. (2010). The security of modern password expiration: an algorithmic framework and empirical analysis. ACM CCS, 176–186.
- 05National Cyber Security Centre. The problems with forcing regular password expiry (blog post), and 'three random words' guidance.