Password Rules That Actually Matter (and the Myths You Can Ignore)
Most of the password advice you've been following for years doesn't actually make you safer — here's what does.
If you've ever been forced to change a password you liked, or told to add a symbol to something that was already secure, you've run into rules that sound like security but mostly just create friction. Some of the most repeated password advice out there is outdated, and a few pieces of it actively make people less safe. Here's what's actually worth doing, and what you can stop worrying about.
Myth: you need to change your password every 90 days
Forced periodic resets used to be standard practice at most companies, and plenty of sites still nag you about it. The theory was reasonable — if a password leaks and nobody knows, a reset schedule limits how long it stays useful to an attacker. In practice, it backfires.
When people are forced to change a password on a timer, they rarely pick something new and random. They make a small, predictable tweak to what they already had — "Summer2024!" becomes "Summer2025!" — which is easy to guess if the previous version ever leaked, and just as easy to forget. Forced rotation also pushes people toward writing passwords down somewhere insecure, because remembering a new one every few months isn't realistic. A password that's genuinely long and unique doesn't need to be replaced on a schedule — it needs to be replaced when there's an actual reason to think it's been exposed.
Myth: mandatory symbols and numbers make a password meaningfully stronger
Plenty of sign-up forms still insist on at least one uppercase letter, one number, and one special character, as if that combination is what keeps an account safe. It's a weaker signal than it looks. Most people satisfy these rules the same predictable way — a capital letter at the start, a "1" or "!" at the end — which means an attacker guessing passwords already knows roughly where to look for the "required" characters.
What actually resists cracking attempts is length. A longer password has dramatically more possible combinations than a short one stuffed with symbols, even before you factor in how predictably people place those symbols. A random 16-character password with no punctuation at all can be far harder to crack than an 8-character one that technically checks every complexity box. If you're replacing a weak password right now, the fastest way to get this right is to skip the mental math and use a Password Generator to create something genuinely long and random in one click — no need to remember a pattern, since a password manager can store it for you.
What actually puts your accounts at risk
The rules above get attention because they're easy to enforce with a form validator. The things that actually correlate with accounts getting compromised are less flashy:
- Reused passwords. The same password (or a near-identical variant) used across multiple sites means one breach anywhere exposes every account that shares it — by far the most common real-world path to a compromised account.
- Short passwords. Anything under 10-12 characters is within reach of modern cracking tools once a site's password database leaks, regardless of how many symbols are crammed in.
- Predictable patterns. Keyboard walks, birthdays, pet names, and "word + year" formulas are the first things automated guessing tools try, because they're the first things people actually pick.
The fix for all three is the same: generate a long, random, unique password for each account instead of reusing or hand-crafting one. It's a habit, not a one-time cleanup — every new account is a chance to either reuse an old password out of convenience or start it off right with a fresh one. If you'd rather build a password you can actually type from memory for the accounts that need it, our guide on building a password you'll actually remember covers that trade-off.
The short version
Ignore the theater — a mandatory symbol here or a forced reset there isn't what's protecting you. What matters is length, uniqueness across sites, and not relying on patterns a guessing tool has already seen a million times. Fix those three things and you've addressed the vast majority of real password risk, no 90-day calendar reminder required.
While you're securing your logins, it's worth tidying up the rest of your digital odds and ends too — if you're sharing a WiFi password or a link on a flyer, our QR Code Generator turns it into a scannable code in seconds, and if you're labeling inventory or assets, the Barcode Generator handles that just as quickly. Both run entirely in your browser, free, no sign-up.
Frequently asked questions
- Should I still change my passwords regularly?
- Only when there's a real reason — a data breach notice, a shared password that a former employee or roommate might still know, or a site telling you your account was accessed from somewhere unfamiliar. Rotating on a fixed schedule for no reason tends to produce weaker, more predictable passwords, not stronger ones.
- Do special characters actually make a password stronger?
- Length matters far more than symbol-stuffing. A long, random passphrase without a single special character can be harder to crack than a short password crammed with "@" and "1" in predictable spots. Mandatory-symbol rules mostly succeed at making passwords annoying to type, not meaningfully harder to guess.
- What's the single biggest password mistake people make?
- Reusing the same password, or a close variant of it, across multiple sites. One breach at any of those sites exposes the password everywhere else it's used — this is a bigger real-world risk than password length or complexity for most people.
- What should I actually do to secure my accounts?
- Use a unique, sufficiently long password for every account, turn on two-factor authentication where it's offered, and use a password manager so "unique and long" doesn't mean "impossible to remember." A generator makes the first part trivial.