A short history of password advice

Why the old rules spread

Early password policy worked from an understandable assumption: if weak passwords are bad, then stricter visible rules must be better. That assumption produced a generation of composition rituals that looked serious to managers, auditors, and procurement teams because they were easy to count and easy to teach. A field can check whether a password contains uppercase, lowercase, number, and symbol. A policy can state that secrets expire every ninety days. A compliance review can verify whether the rule exists. All of this created a strong institutional illusion of control. While defenders were measuring whether users complied, users were learning how to satisfy the form with the least disruption possible, and attackers were learning the same lesson from breach data at scale. People rotated month names, incremented a digit, reused the same structural template across services, and called the result security because the system called it compliant.

That may sound like a simple story of failure, but I would argue the deeper problem was a mismatch between administrative convenience and attacker economics. Composition rules solved the problem of rule expression. They did not solve the problem of predictability. In some cases they worsened it by corralling users into a narrower set of highly legible habits. The famous examples remain famous for a reason. A password like Summer2026! still looks respectable to a non-specialist because it contains visible effort. To a cracking model trained on years of real password behaviour, it looks like precisely the kind of output those rules were always going to generate.

What changed, and what did not

The standards changed once the evidence became hard to ignore. Large breach corpora, usability work, and verifier-side research made it increasingly difficult to defend the older mythology that more ritual automatically meant more security. NIST's current digital identity guidance is the clearest public marker of that turn.[1] It moved away from routine password expiration, put more weight on allowing length, and emphasised verifier-side practice such as screening compromised passwords, controlling online abuse, and treating user behaviour as a design constraint rather than as an inconvenient afterthought. That was a substantive shift because it accepted an awkward truth. Advice that predictably generates workarounds is not a successful control just because it is strict.

Even so, a great many systems still look as if that shift never happened. Some of that is technical debt, and some of it is political debt. Password logic is buried in old identity products, procurement templates, outsourced platforms, and support workflows that nobody wants to revisit unless the failure cost becomes too visible to ignore. There is also a cultural problem that is harder to admit. Simpler, evidence-based rules can look permissive to non-specialists because they do not make users feel the burden as sharply. Better hashing, stronger blocklists, rate limiting, passkey support, and phishing-resistant factors are stronger controls than many old composition rituals. They are also less theatrical. Institutions are often slow to trade a dramatic control for a better quiet one.

Why the history is still operational

The history matters because it still shows up in current enforcement and current product design. The 2025 regulatory action tied to the 23andMe breach was not a lesson about exotic password theory.[2] It was a lesson about the persistence of replayable credentials, weak surrounding controls, and governance that lagged behind the threat reality long enough to become expensive. That is the modern form of the older problem. Organisations keep visible friction in place, postpone structural fixes, and hope the appearance of seriousness still counts for something. Usually it does, until the incident makes that accounting impossible to sustain. Users should therefore read password policy as a signal. A service that allows long passphrases, supports password managers cleanly, screens weak choices, and offers stronger authentication options is often operating from a more current understanding than one still obsessed with ceremonial complexity. That is not a perfect test. It is still one of the better ones, because bad password policy rarely survives on evidence alone. It survives on habit, institutional lag, and the enduring marketability of visible effort.