| Characters | Include | Only one |
|---|---|---|
| Lower case (a-z) | ||
| Upper case (A-Z) | ||
| Numbers (0-9) | ||
Symbols !#$%&*+-=?@^_~.:;,()[]{}/ |
Length matters more than anything else. Each extra character multiplies the number of guesses needed, so 16 characters or more is a good choice when a website allows it.
Use a different password for every website, and keep them in a password manager so you do not have to remember them. If one website is breached, your other accounts stay safe.
Limiting a type to Only one makes the password a little weaker, so make it a little longer to make up for it.
Some websites refuse characters such as @, #, quotes or
&. This is a weakness in the website, not your password. The usual causes are:
• Web addresses : # starts the fragment of a URL and @ separates
a user name from the host, so a password passed in a URL without encoding gets cut short.
• Configuration files and scripts : # starts a comment in many of them, so
everything after it is silently dropped.
• Older systems : some mainframe and legacy systems only allow a small set of characters,
and @ # $ can change meaning between character sets.
• Over-cautious filtering : symbols are blocked in the belief that this stops attacks,
when the real fix is to handle the input safely.
Current guidance from NIST says websites should accept all printable characters and spaces, and should not force rules such as needing a symbol. When a website is fussy, untick Symbols and choose a longer length instead.