Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?

If you don't have any requirements on the password then probably 90% of users will use their name or something just as insecure, but they will not be as prone to forget their password.

But on the other hand if you have to have a password with upper and lowercase characters, numbers and special characters like ! % €, that increases the problems (and associated support costs) of users forgetting their password.

So is the any documentation on how to create a password policy that helps the user create passwords they can remember but still have sufficient complexity to them?

share|improve this question
This is probably one of the best explanations why password length is more important than complexity. Enjoy! – Michal Koczwara Mar 26 at 20:16

4 Answers 4

up vote 16 down vote accepted

Some links and recent research related to policies and the actual resistance to cracking of the resulting passwords is presented by Matt Weir in Reusable Security: New Paper on Password Security Metrics and CCS Paper Part #2: Password Entropy

One quick takeaway is noted: "forcing users to change their password every six months isn't very useful"

See also other questions here like this one.

share|improve this answer
Credit to @Marcin for sharing this link in our DMZ chat room today.... – nealmcb Apr 21 '11 at 20:16
There is one very good reason to force users to change passwords: applications that save passwords. Unless all the laptops that can connect to your network have encrypted drives and the only smart phones that can connect were made by RIM and have enforced encryption you will have devices that saved passwords in clear. Not to mention Internet facing web sites that use AD or LDAP for authentication. – Hubert Kario Aug 14 '11 at 13:27

Passwords are generally considered fundamentally broken, so that any password policy is an attempt to shore things up at best. Having said that, a 'best practice' password policy will typically include at least the following requirements, in addition to minimum password length:

Password Aging:

A maximum age for the password, so that the same password is not used indefinitely

A password history, to stop users changing back to one of N previously used passwords (and thus effectively not changing it at all).

Some policies will also have a minimum age, to stop people changing their password N times (and thus effectively bypassing the password history mechanism, and not changing it at all).

(Notice the last two of these controls are to stop users attempting to get round the first! This is yet another clue that passwords are pretty broken)

Password Complexity:

Typically these will include requirements for 'special' characters, or use of several character classes, with the goal being to increase the effective number of bits in the password and increase the amount of time it takes to brute force a password.

It is also useful to have a policy that disallows not just dictionary words (such as password), but dictionary derived words (e.g. password123, drowssap321 etc). The goal here is to prevent dictionary attacks which can speed up automated password cracking.

Beyond this it is possible to debate all sorts of other requirements and exact values for the various parameters (must users change passwords every 90 days or 30 days or every 5 minutes? etc), as well as the amount of entropy you gain/lose by complexity requirements - but where these things matter greatly then passwords are almost certainly not a good enough control in the first place.

share|improve this answer
The question is about research, and notes that the issues are surprisingly complicated. Are you aware of any actual research findings that support any of these policies and compares the benefits to the downsides? – nealmcb Apr 21 '11 at 20:21
@nealmcb the question is actually a bit conflicted in what it is asking it a recommended policy or an explanation of how the policy improves things or both? I took it to mean both but at a simple level - i.e. not just the policy controls but the rationale why. Having said that I upvoted your answer with the link to the research as well - however while I think papers like that are interesting they really don't change the fundamental conclusion which is that passwords are broken. They just help us understand how badly. – frankodwyer Apr 21 '11 at 20:37
Yeah - and this isn't a science yet..... But +1 for "passwords are broken" :) – nealmcb Apr 22 '11 at 2:11

It is my understanding that developing a balance between security and usability is an on-going battle. Ideally, users should use the most secure password possible but many of them (possibly all) cannot remember these complex strings.

It's my personal experience that the most secure passwords are phrases or the first letter of phrases that I know. By doing this it creates a seemingly arbitrary string of letters (using the phrase: You can't guess this password easily --- ycgtpve). Then require a number and it will create a difficult password that a hint will not divulge easily.

As far as documentation goes I managed to find a couple resources on creating powerful passwords:


This article outlines how to instruct users on good password practices.


This article gives good algorithms to creating difficult passwords which are easily remembered.

Hope this helps.

share|improve this answer
Thanks for your comments, I am familiar to the first letter method. But i was more interested in a system policy instead of a personal one. – KilledKenny Apr 21 '11 at 17:02
If it's not usable, it's not secure. (I don't think it's fruitful to view it as a battle between usability and security. I think security folks need a bit of a mindset change; they need to say that usability is a fundamental requirement, without which you've got nothing. The question is how to find usable security mechanisms.) – D.W. Apr 21 '11 at 23:42
@D.W.: If a password can be cracked by a 15 minute rainbow table search (every alpha-only password less than 9 characters) or a one week brute force attack is not secure. – Hubert Kario Aug 14 '11 at 12:45

Here's a little drawing: enter image description here

And the study that support it.

share|improve this answer
xkcd/936 is a meme in InfoSec with many studies pro/con. – schroeder Mar 26 at 17:45
@schroeder I've posted a pro study, could you post a con? – Typo Mar 27 at 1:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.