Your password policy still demands a capital, a number and a symbol

You’ve seen the box a thousand times. Sign up for something, pick a password, and the little checklist lights up: at least one uppercase letter, at least one number, at least one symbol. So you do what everyone does — take a word you can remember, capitalise the first letter, stick a 1 on the end and an ! after that. Password1!. The box turns green. You’re through.

Somewhere along the way this became the definition of a “strong” password: not one that’s actually hard to guess, but one that satisfies the checklist. And because every system asks for the same three things, everyone reaches for the same three tricks. The result is millions of passwords that look complex to the form and are utterly predictable to anyone trying to break in.

That’s the quiet failure here. Not a broken setting, but a rule almost every small organisation still enforces without ever revisiting it — a rule that, it turns out, makes passwords weaker rather than stronger, and which the body that popularised it has now formally dropped.

The myth, stated fairly

The belief is sensible on its face. A password made only of lowercase letters has fewer possible combinations than one that also uses capitals, digits and punctuation. Force people to draw from a bigger pool of characters, the reasoning goes, and you make each password harder to crack. Composition rules — one of these, one of those — were an easy way to nudge everyone away from password and 123456, and for a long time they were the standard advice, baked into every sign-up form and every audit checklist.

So if your policy still insists on a capital, a number and a symbol, you’re not being lazy. You set it up because that was, for years, exactly what good practice looked like.

Why it’s no longer true

The trouble is that people are predictable, and composition rules make them predictable in the same direction.

Told to add a capital, almost everyone capitalises the first letter. Told to add a number, they add a 1, or the current year, or their year of birth. Told to add a symbol, they reach for !. So password becomes Password1!, summer becomes Summer2026!, and the “complexity” you demanded collapses into a handful of patterns an attacker knows by heart. Password-cracking tools don’t try random gibberish first — they try exactly these human transformations, because that’s what the rules reliably produce. A rule meant to widen the search space quietly narrows it.

Meanwhile the rules push people away from the thing that genuinely helps: length. A long passphrase like correct-horse-battery-staple — several unrelated words — is far harder to crack than P@ss1!, because each extra character multiplies the possibilities, and yet it fails a naïve complexity check for want of a digit. So the checklist can reject a strong password while waving through a weak one. And because complex passwords are hard to remember, people cope by reusing one everywhere and writing it on a note by the screen — which is how a leak from one site becomes a break-in everywhere else.

This is why the guidance changed. The United States’ National Institute of Standards and Technology (NIST) — whose earlier advice put composition rules in every policy — has now dropped them outright. The current revision of its digital-identity guidance (SP 800-63B-4, published in August 2025) says verifiers “shall not impose other composition rules (e.g., requiring mixtures of different character types)” — and in standards language “shall not” is a hard prohibition, not a suggestion. Instead it points to length as the thing that matters — a minimum of 15 characters for a password used on its own, or eight where it’s one part of multi-factor login — and requires new passwords to be screened against a blocklist of known-breached and commonly used ones rather than dictated in shape.

There’s a quick way to see whether this bites you.

1. Find your policy. In Microsoft 365 with cloud-managed accounts there’s no tick-box to find: Microsoft Entra ID applies a fixed built-in policy (a minimum of eight characters, three of four character types) that you can’t change in either direction — what you can control there is the banned-password list in Entra password protection. For on-premises Windows and Active Directory it’s set explicitly under Group Policy: Computer Configuration → Windows Settings → Security Settings → Account Policies → Password Policy, in the setting “Password must meet complexity requirements”. In Google Workspace, look in the Admin console under Security → Authentication → Password management — you’ll find length and strength controls there, but no character-type demands, because Google doesn’t offer any.

2. Read the rule. If “Password must meet complexity requirements” is Enabled, or your sign-up copy still lists “must contain an uppercase letter, a number and a symbol”, the myth is live in your organisation.

3. Notice the tell-tale sign without admin access. Look at your own password, honestly. If it’s a memorable word with a capital at the front and a 1! at the end, the rule has shaped it into exactly the pattern attackers try first.

What to do instead

The better default is simpler than the rule it replaces, and it’s what the current guidance actually recommends.

Ask for length, not character theatre. Set a longer minimum — enough to require a passphrase of several words rather than a single tortured word — and drop the mandatory capital/number/symbol demand. A password nobody can remember is a password that gets written down; a long passphrase is both stronger and easier to live with.

Screen against known-breached passwords. The real risk isn’t a password lacking a symbol, it’s a password that has already leaked. Both Microsoft’s Entra password protection and third-party checks can reject passwords found in breach lists — that stops Password1! far more effectively than any composition rule.

Encourage a password manager. Once people aren’t forced to invent memorable-but-complex secrets, a manager can generate a long, random, different password for every account, and nobody has to memorise any of them.

Put the real defence on the front door. Two-factor authentication — a code or prompt on top of the password — stops the phishing and credential-stuffing attacks that no amount of complexity ever could. If you change one thing after relaxing the rules, make it turning on two-factor for everyone.

If this feels like lowering the bar, it isn’t — you’re moving the bar to where it actually stops people. You drop a rule that was quietly manufacturing Password1! across your organisation, and swap it for length, a breach check and two-factor: fewer frustrated users, and passwords that finally match how accounts really get broken into.