Example strong diceware password:

widow stout harvey crest zomba zloty butyl

This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, which seem to accept this very password (tested))

Example modified diceware password that will be accepted by most sites:

Widow stout harvey crest zomba zloty butyl1.

Is this password much stronger than the original one? I doubt.

Example password that will be accepted by most sites (checked on Outlook, which rejected the orignal password):


This password seems to me to be substantially weaker than the one that was originally rejected!!

And yet - in my experience this is what most sites still require.

Given that most does not include Google nor Stackoverflow - is this requirement simply outdated, but most sites still did not catch up? Or are there any actual reasons why lowercase/uppercase/numeric/punctuation is still to be required?

  • There are some standards, such as PCI-DSS, that explicitly require passwords with multiple character classes (a-z, A-Z, 0-9, other printable symbols (including multibyte characters) are considered distinct character classes in this context), and have released updates to these standards maintaining that requirement even after the NIST standards explicitly state not to require (but to allow unrestricted use of) multiple character classes. Thus, it becomes a case where security teams must do risk assessments and pick a standard. – Ghedipunk Sep 25 '19 at 18:26
  • 2
    This sounds like a monkey problem to me. – AndrolGenhald Sep 25 '19 at 19:47

First of all, there are different criteria on what is a good password.

Facebook will happily let you in using a password with reversed case. Others will frown at that. A few years ago, Outlook.com wouldn't have let you use a password with more than 16 characters. Each site may have different password policy, which leads to different implementations. Some sites require symbols, other consider that a long-enough password is enough.

The main problem, however, is that the site doesn't know how the password was generated. A diceware-generated "widow stout harvey crest zomba zloty butyl" has about 90 bits of entropy. Whereas "this is my password for stack exchange" would have much less (specially if I know you used ""this is my password for outloo.com" at outlook!).

Thus, password meters (such as the validations embedded in those sites) resort to estimating the entroppy of the passwords. Generally, adding capital letters or symbols increases the password space, so it was commonly recommended (or required) that lowercase, uppercase and symbols were present in the password as a proxy to "the password will be hard to crack". This is reinforced by common suggestions to do that.

You will find that usually, when the system can generate a password for you (such as access tokens), it doesn't require all that). Since the password is generated by the server it knows how it is generating it and thet it has enough entropy.

Finally, note that in some systems there may be actual reasons for requiring certain length or types of characters. Mainly because they are used (copied) into systems that require it, or because of regulatory reasons, they need to require that, even if it is not that important.

  • 1
    A 7 word diceware password has far more than 15 bits of entropy. You may want to check your math on that one – Conor Mancone Sep 26 '19 at 1:52
  • I calculated it a couple of times since it didn't seem right to me. Looking to it fresh, I was probably doing log₂ (7×7776) instead of 7 × log₂ (7776), sorry. Updated – Ángel Sep 26 '19 at 10:33

Simply put, because it increases entropy.

The word widow could be written in the following ways:

  • widow
  • Widow
  • wid0w
  • w1dow
  • w!d0W
  • ...

You might argue that a simple rule in hashcat would include all those examples, and you would be right, but it still increases cracking time, as any feasible combination would need to be included.

If an attacker could make the reasonable expectation that the vast majority of passwords would only consist of lowercase letters now, then cracking time could be sped up significantly by just removing most permutations.

That's why mixing and matching case is still solid advice. For instance, you could capitalize the second letter in every word, and get

wIdow sTout hArvey cRest zOmba zLoty bUtyl

An attacker who only picked the rules examplified above would not crack this diceware password, even if they knew all the components of it and their order.

  • 1
    I don't think this answers the core of the question: Yes, using character from multiple classes increases the search space and is great for users... but I interpret the question as, why do site owners still require multiple classes, when there are (seemingly) more effective ways to increase a password's entropy? – Ghedipunk Sep 25 '19 at 18:29
  • @Ghedipunk I think the answer to that question is honestly "Because everybody else is doing it." AndrolGenhald's comment describes it best. But "Does it make sense to have multiple character classes?" is still a very closely related question. I honestly don't know if I should delete the answer or not. – MechMK1 Sep 25 '19 at 20:57
  • Don't get me wrong, this is good information. I'm at a loss to come up with an answer to the core of this question, other than my comment which boils down to "because certain very influential standards, which I don't like, say to do that." (I also wouldn't recommend a diceware password; I'm a full evangelist of using password managers with long, unique, random passwords for each account on each site, but that's not what this question is about, either.) – Ghedipunk Sep 25 '19 at 21:09
  • @Ghedipunk But what do you use to secure that password manager database? Or in my case, my os login, before the password manager is available? – MechMK1 Sep 25 '19 at 21:27
  • I tell my users to try to remember only two passwords: The one to log in to your computer, and the one to open your password manager. Since they're the only ones that have to be remembered, they can be very complex (and leet-sp34k modified) Correct Horse Battery Staple passwords... (or to follow your example, cOrr3ct hOrs3 bAtt3ry sT4p!3.) I also point out to my users that this is good in principle, but that I can follow it in practice only about 95% despite best efforts... The other annoyance with password managers is going to conference room computers... I write the PW on note cards. – Ghedipunk Sep 25 '19 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.