Password Character Requirements Explained
Last updated: September 2026
Almost every signup form has some version of password character requirements: "at least 8 characters, one uppercase letter, one number, one special character." Here's what those requirements are actually trying to accomplish, and where they fall short.
What a typical requirement looks like
| Requirement | Example that satisfies it |
|---|---|
| 8+ characters, 1 uppercase, 1 number | Riverbank7 |
| 12+ characters, 1 symbol, 1 number | Meadow-Falcon42! |
| No requirements, just a minimum length | correct-battery-lagoon-shale |
Note that satisfying a rule isn't the same as being strong — Riverbank7 technically meets the first requirement above but follows a predictable "word + capital + digit" pattern that's easy to guess.
Why services set these rules
Character-class requirements exist mainly to stop the weakest possible passwords — password, 12345678 — from being accepted at all. They're a floor, not a strength guarantee. A password can satisfy every rule on the list and still be weak if it follows a predictable pattern.
Where character rules fall short
- They don't stop predictable substitutions like P@ssw0rd, which satisfies most rule sets while being one of the first guesses any cracking tool tries.
- They can push people toward shorter passwords, since meeting four separate rules in a short string feels "done" even though length matters more.
- NIST's current guidance (SP 800-63B) actually recommends against mandatory periodic password changes and complex composition rules, favoring length and screening against known-breached passwords instead.
Frequently asked questions
Does meeting the character requirements mean my password is strong?
Not necessarily. Requirements set a minimum floor, but a password that satisfies every rule can still follow a predictable pattern that's easy to guess. Use the entropy calculator to check the real strength.
Why do some sites still require special characters if NIST says it's not necessary?
Many services haven't updated their password policies to match current guidance. When a site requires it, our generator can include symbols so you satisfy the rule without falling back on predictable substitutions.
What's the actual minimum length I should use?
16 characters where the service allows it. See our full guide for the complete picture.