Why Password Rules Are So Frustrating (and What Good Ones Look Like)

Everyone has hit the wall of absurd password rules: must contain an uppercase letter, a number, a symbol, but not that symbol, at least eight characters, no more than sixteen, not similar to your last password, and no, that one is taken. It is one of the most universally frustrating experiences on the internet, and, ironically, many of these rules make passwords less secure, not more. The Password Game turns this absurdity into a playful challenge, and this article explains why the rules are like this and what good ones actually look like.

Behind the frustration is a real story about how security thinking has evolved. The rules that annoy you were mostly designed with good intentions and outdated assumptions, and the modern guidance quietly contradicts much of what sites still enforce.

Where the annoying rules came from

The classic complexity rules, an uppercase letter, a lowercase letter, a number, a symbol, date from an era when the main worry was people choosing dictionary words like 'password' or 'dragon'. Forcing a mix of character types was meant to push people away from those obvious choices and enlarge the space of possible passwords. It was reasonable advice for its time. The problem is that it optimised for the wrong thing and assumed people would comply in helpful ways, which they mostly did not.

Why the rules backfire

Complexity requirements often make real-world security worse, for a very human reason: faced with 'you must include an uppercase, a number and a symbol', people do the minimum in the most predictable way. They capitalise the first letter, put a '1' and a '!' at the end, and reuse a base word. So 'password' becomes 'Password1!', which satisfies every rule and is trivially guessed, because attackers' tools try exactly these transformations first. Meanwhile the rules make passwords harder to remember, which pushes people toward reuse across sites and writing them on sticky notes, both far bigger risks than a missing symbol. The rules meant to strengthen passwords end up encouraging weak, reused ones.

What good password rules look like

Modern security guidance, including from standards bodies, has shifted sharply. Good rules today look like this:

• Require length, not complexity: a healthy minimum length (and allowing long passphrases) does more than any character-type rule.
• Allow all characters, including spaces, and set a generous maximum, so passphrases and password-manager output work.
• Check against known-breached passwords: rejecting passwords that have appeared in leaks stops the genuinely weak ones.
• Drop forced periodic changes: making people change passwords every 90 days just produces predictable variations and is no longer recommended.
• Do not impose arbitrary composition rules that push people toward predictable patterns.

In short: measure what actually makes a password hard to guess, length and unpredictability, and whether it has been breached, rather than counting character types.

The absurdity, gamified

The reason a 'password game' is fun is that it exaggerates the real experience to the point of comedy: rule after contradictory rule piling up until making a valid password becomes an absurd puzzle. It is entertaining precisely because it captures something true about how over-engineered password rules feel. Playing it is a lighthearted way to appreciate why the serious guidance has moved toward simplicity, fewer, better rules that target real weakness, rather than the ever-growing list of fiddly requirements that only frustrate users and encourage bad habits.

Making strong passwords painless

The way to escape password frustration entirely is to stop crafting passwords by hand. Let a password generator create a long, random, unique password for each site, store them in a password manager, and you never have to satisfy a fiddly rule set or remember anything, the generated password will comfortably pass any requirements while being genuinely strong. If you want to understand how strong a given password is, a password strength checker shows you, and for machine secrets a random key generator does the same job for keys.

The hidden costs of bad password rules

Beyond the day-to-day annoyance, over-strict password rules impose real costs that their designers rarely see. Every extra requirement is a small barrier that causes some people to abandon a signup entirely, and for a business that is lost users. Those who do push through are nudged toward coping strategies that undermine security: reusing a password that they know satisfies the rules, writing passwords down insecurely, or storing them in unprotected notes. The rules meant to protect accounts end up training users into precisely the behaviours that put accounts at risk, and support teams then absorb a steady stream of password-reset requests from people who could not remember their fiddly creation.

There is also an accessibility and fairness dimension. Complex, arbitrary rules are hardest on the people who are already least comfortable with technology, widening rather than narrowing the gap. And rules that block password managers, by forbidding pasting, capping length too low, or banning the characters managers generate, actively prevent the single most effective thing an ordinary person can do for their security. Recognising these hidden costs is what has driven the modern guidance toward simplicity: the best password policy is one that sets a sensible length, blocks known-breached passwords, allows everything else including long passphrases and pasted manager output, and otherwise gets out of the way. Fewer, smarter rules protect accounts better while frustrating people less, a rare case where the more usable option is also the more secure one. The absurd pile-up of requirements that a password game parodies is, in the end, a cautionary tale about confusing the appearance of security with the real thing.

To recap: the maddening password rules come from an older era of security thinking and often backfire, because forcing complexity pushes people toward predictable, reused passwords that are easy to guess. Good modern rules favour length over complexity, allow passphrases and all characters, block known-breached passwords, and drop forced changes. Enjoy the absurdity in a password game, but in real life sidestep the whole problem by generating long random passwords and letting a manager remember them, that is how you get genuinely strong passwords without the frustration.