Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?

If you don't have any requirements on the password then probably 90% of users will use their name or something just as insecure, but they will not be as prone to forget their password.

But on the other hand if you have to have a password with upper and lowercase characters, numbers and special characters like ! % €, that increases the problems (and associated support costs) of users forgetting their password.

So is the any documentation on how to create a password policy that helps the user create passwords they can remember but still have sufficient complexity to them?

  • 1
    This is probably one of the best explanations why password length is more important than complexity. imgur.com/gallery/zFyBtyA Enjoy! Commented Mar 26, 2015 at 20:16
  • @MichalKoczwara: howsecureismypassword is not a good estimation of password complexity, it doesn't even recognize that P@55word is a dictionary-based password... Commented May 30, 2016 at 9:56

5 Answers 5


Some links and recent research related to policies and the actual resistance to cracking of the resulting passwords is presented by Matt Weir in Reusable Security: New Paper on Password Security Metrics and CCS Paper Part #2: Password Entropy

One quick takeaway is noted: "forcing users to change their password every six months isn't very useful"

See also other questions here like this one.

  • 1
    Credit to @Marcin for sharing this link in our DMZ chat room today....
    – nealmcb
    Commented Apr 21, 2011 at 20:16
  • 1
    There is one very good reason to force users to change passwords: applications that save passwords. Unless all the laptops that can connect to your network have encrypted drives and the only smart phones that can connect were made by RIM and have enforced encryption you will have devices that saved passwords in clear. Not to mention Internet facing web sites that use AD or LDAP for authentication. Commented Aug 14, 2011 at 13:27
  • @HubertKario: if an application stores a password and then allows it to be stolen because it is stored non-securely, how is changing the password, even changing it every day, going to stop the application from leaking it again? The problem with your example is not in the password used or in how often it is changed, it's a problem with how the application protects any password it stores. Commented May 29, 2016 at 13:47
  • @MarkRipley: the problem is that you can't depend on users to remember which passwords were saved by which applications on which phones or computers. And people loose computers and phones all the time. By having passwords that expire you will at least get alerts that an expired password is used. Without it you're blind. Commented May 30, 2016 at 9:47

Passwords are generally considered fundamentally broken, so that any password policy is an attempt to shore things up at best. Having said that, a 'best practice' password policy will typically include at least the following requirements, in addition to minimum password length:

Password Aging:

A maximum age for the password, so that the same password is not used indefinitely

A password history, to stop users changing back to one of N previously used passwords (and thus effectively not changing it at all).

Some policies will also have a minimum age, to stop people changing their password N times (and thus effectively bypassing the password history mechanism, and not changing it at all).

(Notice the last two of these controls are to stop users attempting to get round the first! This is yet another clue that passwords are pretty broken)

Password Complexity:

Typically these will include requirements for 'special' characters, or use of several character classes, with the goal being to increase the effective number of bits in the password and increase the amount of time it takes to brute force a password.

It is also useful to have a policy that disallows not just dictionary words (such as password), but dictionary derived words (e.g. password123, drowssap321 etc). The goal here is to prevent dictionary attacks which can speed up automated password cracking.

Beyond this it is possible to debate all sorts of other requirements and exact values for the various parameters (must users change passwords every 90 days or 30 days or every 5 minutes? etc), as well as the amount of entropy you gain/lose by complexity requirements - but where these things matter greatly then passwords are almost certainly not a good enough control in the first place.

  • 7
    The question is about research, and notes that the issues are surprisingly complicated. Are you aware of any actual research findings that support any of these policies and compares the benefits to the downsides?
    – nealmcb
    Commented Apr 21, 2011 at 20:21
  • @nealmcb the question is actually a bit conflicted in what it is asking for...is it a recommended policy or an explanation of how the policy improves things or both? I took it to mean both but at a simple level - i.e. not just the policy controls but the rationale why. Having said that I upvoted your answer with the link to the research as well - however while I think papers like that are interesting they really don't change the fundamental conclusion which is that passwords are broken. They just help us understand how badly. Commented Apr 21, 2011 at 20:37
  • 2
    Yeah - and this isn't a science yet..... But +1 for "passwords are broken" :)
    – nealmcb
    Commented Apr 22, 2011 at 2:11
  • A minimum age rule for passwords means that if your password is compromised, you are out of luck; the hacker has free access to your account until you are allowed to change it again. Nice security there. And if you don't have a minimum age policy, smart users will do the "change it 11 times when I am forced to change it" to overflow the 10 password history. If you want to do this right, you have to have a very large password history and/or only apply a minimum change time policy to an account once the password has been changed at least 5 times in a given day. Commented May 29, 2016 at 13:55

It is my understanding that developing a balance between security and usability is an on-going battle. Ideally, users should use the most secure password possible but many of them (possibly all) cannot remember these complex strings.

It's my personal experience that the most secure passwords are phrases or the first letter of phrases that I know. By doing this it creates a seemingly arbitrary string of letters (using the phrase: You can't guess this password easily --- ycgtpve). Then require a number and it will create a difficult password that a hint will not divulge easily.

As far as documentation goes I managed to find a couple resources on creating powerful passwords:


This article outlines how to instruct users on good password practices.


This article gives good algorithms to creating difficult passwords which are easily remembered.

Hope this helps.

  • Thanks for your comments, I am familiar to the first letter method. But i was more interested in a system policy instead of a personal one. Commented Apr 21, 2011 at 17:02
  • If it's not usable, it's not secure. (I don't think it's fruitful to view it as a battle between usability and security. I think security folks need a bit of a mindset change; they need to say that usability is a fundamental requirement, without which you've got nothing. The question is how to find usable security mechanisms.)
    – D.W.
    Commented Apr 21, 2011 at 23:42
  • @D.W.: If a password can be cracked by a 15 minute rainbow table search (every alpha-only password less than 9 characters) or a one week brute force attack is not secure. Commented Aug 14, 2011 at 12:45

Here's a little drawing: enter image description here

And the study that support it.

  • 1
    xkcd/936 is a meme in InfoSec with many studies pro/con.
    – schroeder
    Commented Mar 26, 2015 at 17:45
  • @schroeder I've posted a pro study, could you post a con?
    – Typo
    Commented Mar 27, 2015 at 1:16

Since password restrictions are usually defined by people with a strong technical background but zero insight into psychology, the status quo ultimately decreases security.

What security guys fail to understand is that the users do not have to memorize ONE password. One might think "a person should be able to memorize one password, even with my crazy special character, numbers and upper-lowercase restrictions, right?"

Well, yes.

But the user has to memorize not one password, but five different ones at work plus more at home. Now we have a situation where the user has five passwords on different change timers where the first needs at least three special characters, the second may not start with a number, the third disallows "$" and "/" for whatever reason, the fourth must be exactly 8 characters long and the fifth needs to at least 10 characters long and needs to have 3 numbers.

Now guess what the users will do! Will they...

a) devote infinite resources to finding the perfect password system that appeases all change timers and password restrictions at once, uses completely independent passwords for the different systems and yet still can be memorized

b) throw their hands in the air and give up. Write the passwords on a piece of paper (unencrypted of course) and stick it into a desk drawer.

c) use every trick in the book to somehow appease all restrictions and still be able to remember all passwords. This includes using the same password for all systems whenever possible (including low-security systems), using running numbers to appease the change timers, using a very small set of default passwords so they can guess their own password in a couple of tries (amongst other stuff).

Somehow most security guys seem to believe that a) is the correct answer. For the life of me I can not figure out why, though.

  • 1
    What about "(d) Remember ONE strong password and store all other passwords in a secure password manager. These can be as complicated as needed because the user never even sees them."?
    – Ben
    Commented Jan 20, 2016 at 15:52
  • @Ben See the first sentence.
    – Cypher
    Commented Jan 26, 2016 at 17:42
  • @Cypher I've seen enough marketing for password managers that focus on "Do you HATE memorizing passwords? Check this out!" to tell me that an average person can be more than happy installing and using one, they just need to be given a good hook or have a pushy friend/significant other to get them to try it out.
    – Ben
    Commented Jan 26, 2016 at 17:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .