Complexity requirements, forced rotation and composition rules were adopted almost universally and made outcomes worse in measurable ways. Why each backfired, what humans reliably do when given a rule they cannot satisfy honestly, and what the current guidance says instead.
A rule aimed at the wrong thing
The composition rules were built for one attack: offline guessing against a stolen hash. Widen the alphabet, widen the space the attacker has to cover.
Against that attack, in that era, the reasoning was sound.
The dominant ways credentials are lost then changed — reuse, phishing, interception, breach of somebody else's database — and the rules did not change with them. They kept defending the position long after the fighting moved.
What people do with a rule they cannot satisfy
The response to one capital, one digit, one symbol is not random. It is a formula.
Capital at the front. Digit and punctuation at the end. Something memorable in the middle, because the middle is the part a person has to retain.
That regularity is the problem. Entropy is a measure of how little the attacker can predict, and a rule that produces the same shape across most of a population has told the attacker where to look. The guessing space widened on paper and narrowed in practice.
Forced rotation, and the counter that defeats it
Rotation was meant to cap the useful life of a stolen credential — a reasonable aim, with a defensible mechanism behind it.
What it produced was suffixes. Somebody required to invent a memorable secret every ninety days derives it from the one they already remember: increment the number, swap a letter for a symbol, move the capital.
Which makes the new value predictable from the old one. That is precisely the property rotation existed to destroy, and the schedule was what created it.
The reuse it caused
This is the serious harm, and it is larger than the others combined.
Every additional rule raises the cost of holding a different secret for each place. People pay that cost by not holding different secrets.
Reuse is a far worse weakness than mediocre complexity, because it changes what a single breach means. One database compromised anywhere becomes access to email, which becomes access to everything that resets through email.
The rules bought a modest theoretical gain and sold the isolation between accounts to pay for it.
What actually determines difficulty
Length, overwhelmingly.
Each character you add multiplies the space by the size of the alphabet. Each character class you add widens the alphabet a little, once. The first operation compounds and the second does not, which is why four more characters beats a symbol requirement by a distance no amount of punctuation closes.
A passphrase of several ordinary words is both harder to guess and easier to keep in a head than a short string of substitutions — which is unusual, because security and convenience rarely point the same way, and worth taking when it happens.
What the guidance says now
Accept long inputs, with a generous upper limit rather than a mean one.
Permit every character, including spaces, and stop rejecting the ones that complicate somebody else's parser.
Drop composition requirements entirely.
Stop scheduled rotation.
Check the proposed value against lists of credentials known to have appeared in breaches, which is the one screen that targets the actual failure mode.
Rotation after a suspected compromise remains correct. That was always the sound part of the argument; the error was applying it to a calendar rather than to an event.
Why the old rules persist
Not stubbornness. Measurability.
They are written into compliance checklists and audit templates that predate the change and outlive any individual's opinion of them. They can be verified automatically, which makes them cheap to assert and cheap to evidence. And removing them reads, to anyone not close to the subject, as lowering a standard.
A control that is easy to measure will outlive a control that is effective but hard to measure. That is not a fact about passwords; it is a fact about how organisations decide what counts as done.
What to do
A manager holding long, distinct values, so that distinctness stops costing anything.
A second factor on anything whose loss would matter, because it removes the single point the whole argument has been circling.
And attention to the recovery path — the security questions, the backup address, the phone number — which is frequently weaker than the password it can reset, and is where an attacker who has read this article would start.
Close
A control that fights the user is a control whose bypass is being designed, continuously and inventively, by the people it is imposed on.
They will satisfy it. The interesting question is always what they do to make satisfying it possible, because that is the thing you have actually deployed.