Your password must contain a symbol, and not that symbol

Most explanations of password composition rules stop at the point where it starts to matter. This one carries on.

The rules produced a pattern, not variety

Requiring an uppercase letter, a number and a symbol pushes almost everybody toward the same solution, which is a capitalised word, a number and an exclamation mark. Attackers know this, and password cracking tools apply exactly these transformations as their first move rather than their last. The rule therefore reduced the search space it was intended to expand, which is a genuinely elegant failure.

Length is what actually resists guessing, because each additional character multiplies the possibilities rather than adding to them. This is why current guidance from several major security bodies favours long passphrases over short complex strings.

Forced rotation made things worse

Requiring a change every ninety days produced predictable increments, where a password gains a number or a season rather than changing. It also increased writing down, reuse across systems and helpdesk resets, all of which are worse than an unchanged strong password. Major guidance now recommends against routine forced expiry, changing passwords in response to evidence of compromise instead.

Once the introductory rate lapses, many organisations still enforce rotation because a policy is easier to keep than to revisit, which is the compliance ratchet again. Where you have a choice, a long unique password kept until there is a reason to change it is the better arrangement.

The rules that are actively harmful

Maximum length limits, banned characters and rules against pasting all suggest a system storing passwords in a way it should not be. A correctly stored password is hashed to a fixed length, so the original length is irrelevant to storage and a low limit implies something else. Blocking paste specifically breaks password managers, which are the single most effective consumer security tool available.

Security questions with publicly discoverable answers are a separate and long-criticised weakness that persists in many recovery flows. Treating unusual restrictions as information about the system is reasonable, particularly when deciding what else to store there.

What actually works now

A password manager generating long random passwords, unique per site, removes reuse and memorability from the problem entirely. Blocklists of known breached and common passwords catch the genuinely weak choices without imposing rules on everybody else. Rate limiting and lockout thresholds do more against online guessing than any composition rule can, because they attack the attempt rate.

Somewhere in the release notes, multi-factor authentication addresses the case where the password is already known, which is the case that actually causes most account takeovers.

None of this requires a user to remember anything except one strong passphrase and where the backup codes are.

Reuse is the real risk

Credential stuffing takes username and password pairs from one breach and tries them across many other services automatically. It works because reuse is common, and it is by a wide margin the most successful attack against ordinary consumer accounts. That means the strength of any individual password matters far less than whether it appears anywhere else.

Read the terms and there it is: breach notification services let you check whether an address appears in known dumps, which is a useful five-minute exercise. The email account is the one to secure first, since it is the recovery route for everything else you own.

A setup that survives contact with reality

Use a password manager and let it generate everything, including the answers to security questions, which do not have to be true. Secure the email account with a strong unique password and a second factor before anything else. Use a long memorable passphrase for the manager itself, since that is the one you must actually remember.

Once the introductory rate lapses, keep recovery codes offline and somewhere you will find them, which is the step that turns this from fragile into robust. And when a site rejects your password for containing the wrong symbol, note that it has just told you something about itself.

The takeaway

Length and uniqueness. Everything else in the rules is theatre.

The fix is usually trivial, which is the most annoying part.