The Truth Behind "Include Uppercase, Lowercase, Numbers, and Symbols"

Every time you create a new account, you're told: "Password must be at least 8 characters and include uppercase, lowercase, numbers, and symbols." Annoying, right? But this rule has a surprising history - and the shocking truth that it's not actually very effective.

Where It All Began - The 2004 NIST Document

The origin of password complexity rules traces back to "NIST Special Publication 800-63," published in June 2004 by the National Institute of Standards and Technology (NIST). This document recommended that "passwords should mix uppercase, lowercase, numbers, and symbols," and web services worldwide adopted this rule.

However, in 2017, the document's author Bill Burr confessed in a Wall Street Journal interview that "much of that advice was wrong." The complexity rules merely led users to create predictable patterns like "P@ssw0rd!" and contributed little to actual security improvement.

Why Complex Passwords Are Less Effective Than You'd Think

Humans respond to complexity rules with remarkably predictable behavior.

  • Need uppercase? Capitalize only the first letter (Password)
  • Need numbers? Add 1 or 123 at the end (Password1)
  • Need symbols? Add ! at the end (Password1!)
  • Replace "a" with "@" and "o" with "0" (P@ssw0rd)

Attackers are well aware of these patterns and include them in their dictionary attack lists. In other words, even a password that looks complex can be easily cracked if the pattern is predictable. In a credential stuffing attack, which replays leaked password lists against other services, these predictable passwords are the first ones tried.

What Makes a Truly Strong Password

The shift away from complexity rules toward prioritizing "length" came with the NIST guideline revised in June 2017 (SP 800-63B). That document has since been superseded by SP 800-63B-4, published in July 2025, but its requirements that verifiers "shall not impose composition rules" mixing character types and "shall not require periodic changes" carry over unchanged. The newer version goes further, setting a minimum length of 15 characters for passwords used as the only authentication factor. Start with the basics of password security, then put the following measures into practice.

  • Long passwords (passphrases): A passphrase stringing together 4 or 5 random words, like "correct horse battery staple," is stronger and easier to remember than a short, complex password
  • Password managers: Tools that generate and manage a different random password for every service. Remember one master password and you can drop password reuse to zero
  • Two-factor authentication (2FA): Using an authenticator app on your phone or a security key in addition to your password. It blocks unauthorized logins even if the password leaks

Run the numbers and the case for length becomes clear. An 8-character random password drawn from 94 characters, symbols included, gives 94 to the 8th power, or roughly 6.1 quadrillion combinations. A passphrase of 4 words drawn from the 7,776-word list published by the EFF comes to about 3.7 quadrillion, so the two are nearly even at that point. The gap opens up afterward: adding one more character, symbols included, multiplies the candidates by only 94, while adding one more word multiplies them by 7,776. A 5-word passphrase reaches about 28 quintillion combinations, roughly 4,600 times the 8-character random password. You can add orders of magnitude while staying within what you can memorize. That is why length takes priority.

The World's Most Commonly Used Passwords

Security firm NordPass publishes a list of commonly used passwords every year, compiled from leaked data. The order changes from year to year, but the names sitting at the top barely change at all.

  • 123456
  • password
  • 123456789
  • 12345
  • 12345678

These passwords can be cracked in less than a second. Even when passwords are stored as hashes, that protection means nothing for passwords this simple.

Summary

Password complexity rules originated from a 2004 NIST document, but the author himself admitted they were "wrong." A long passphrase is stronger and easier to remember than a short, complex password. Combine a password manager with two-factor authentication and you are safer still. Along with strengthening your passwords, it is worth checking the security of your own connection at IP確認さん.

Related Terms in This Article

Two-Factor Authentication An authentication method that doesn't rely on passwords alone. Your last line of defense when passwords are compromised. Encryption Passwords are stored on servers using hashing (one-way encryption). Phishing No matter how strong your password is, entering it on a phishing site means it's stolen.

Frequently Asked Questions

Who created the password complexity rules?

Bill Burr authored NIST Special Publication 800-63, published in June 2004, which recommended requiring uppercase letters, numbers, symbols, and regular password changes. In 2017, he publicly admitted the advice was largely wrong, saying 'Much of what I did I now regret.'

What makes a truly strong password?

Length matters far more than complexity. A passphrase like 'correct horse battery staple' (28 characters) is both stronger and easier to remember than 'P@ssw0rd!' (9 characters). NIST's 2025 guideline, SP 800-63B-4, forbids composition rules and forced periodic changes, and sets a 15-character minimum for passwords used on their own.

What is the most commonly used password in the world?

According to annual analyses of leaked databases, '123456' stays near the top of the list every year, alongside '123456789', 'password', and 'qwerty'. The exact order shifts from year to year, but every one of them can be cracked in under one second.