Overly strict rules can produce more predictable passwords
Aliases: password composition rules · predictable password mutation · composition-rule compliance
What it is
Predictable compliance with password rules occurs when people satisfy mandatory uppercase, lowercase, digit, and symbol requirements through guessable transformations such as capitalizing the first letter or appending a year and exclamation mark. The string looks more complex, but the attacker's effective search space may not grow accordingly. Passing a rule is not the same as resisting guesses.
Why it happens
Memory and cross-service demands encourage minimal changes to familiar roots. Detailed rules become a public grammar that guessing models can prioritize through common substitutions, positions, and dates. Repeated rejection also teaches people to tune a string around the validator instead of choosing a long, independent secret. A policy can therefore increase visible variety while concentrating choices in a few predictable templates.
Studying it
Compare a composition-heavy policy with one centered on length and blocking common or compromised values, using approved synthetic corpora or consented research data. Measure creation success, recovery, password-manager use, estimated guess order, and intended reuse. Do not collect participants' real active plaintext passwords; use controlled creation tasks, irreversible derived measures, or ethically reviewed breach corpora. Character-class count alone is not a strength measure.
Where it stops holding
Not every constraint is harmful. Minimum length, blocking common or compromised values, rate limiting, and multifactor authentication address different threats; compatibility or regulatory constraints can also apply. A long password can still be a quotation, personal fact, or reused secret. This principle targets unsupported composition rules that induce patterned mutations; it does not solve phishing, malware, or server compromise.
Applying it
- Permit long passwords and passphrases, and support paste, autofill, and password-manager generation.
- Replace character-class checklists with screening for common, expected, and compromised values; give an actionable rejection reason.
- Test how often common capitalization, substitution, year, and suffix patterns pass, and use estimated guessing cost as a release measure.
- Layer policy with online-attempt throttling, compromise detection, and multifactor authentication; do not present a complexity meter as proof of total security.