No to hieroglyphics!
A long phrase instead of a forced string of symbols: my take on passwords, their limits, and the choices that actually protect your online accounts.
Sur cette page6 sections
You create an account, choose a password, and then the form stops you. A capital letter is missing. You add it. Now, it needs a number. Then a special character. And not necessarily the one you just chose.
Frankly, I can't stand it. In my daily life, I prefer a long phrase I can remember over a string of characters I have to decipher every time I log in. If it feels like you need 95 special characters just to access a site, I think we've missed the mark.
I'm not saying we should take security lightly. I'm saying a form can make our lives difficult without necessarily protecting our account any better. And as developers, I think we should ask ourselves that question before adding yet another rule.
The problem is that we can end up looking for what will satisfy the form rather than what will actually protect the account. We add the required symbol, move on, and keep a fairly predictable structure.
It's not just my personal annoyance. In its authentication guidelines, NIST, a US standards body, advises against imposing these mandatory character mixes. It specifically recommends rejecting passwords known to be too common or compromised. Password guidelines explain this distinction. It's not a universal obligation for every site, but it gives us a good reason to rethink our habits.
However, "long" doesn't automatically mean "strong". A famous quote, an expected sequence of words, or a phrase containing information easily found about you doesn't become a good choice just because it fills the whole line.
Instead, I suggest looking for a combination of words that is long enough, unpredictable, and that you can remember without building it around your name or date of birth. Randomly chosen words can serve as a starting point; you can then create a mental association to memorise them. There's no need to publish that association as a hint on the account.
Length matters, but you also have to look at how the password was chosen and how the service protects it. So I'm not going to tell you that a phrase will necessarily hold up for billions of years. NIST's explanation of password strength is more useful than that kind of promise.
So you need a different password for every account. And I readily admit that remembering a phrase for every service eventually requires a lot of effort. A password manager can help keep distinct passwords without having to memorise them all. My preference for phrases is no reason to discourage this tool.
And no, just changing the site name at the end of a common phrase is not a solution I would recommend. It quickly leads back to a predictable structure.
When the service allows it, I recommend enabling two-factor authentication: a second verification is added to the login. It's not an absolute guarantee, and not all methods offer the same protection, but it's a useful extra precaution. Cybermalveillance.gouv.fr explains how it works.
And if a password has been compromised, change it. That's not the same as forcing everyone to invent a new one every three months without a identified incident. I prefer a rule that responds to a risk over a constraint added to the calendar.
Let's accept long phrases. Let password managers fill the fields and let users paste their passwords. Let's explain a rejection clearly instead of letting someone try ten random variations.
And let's work on the rest: spotting already compromised passwords, limiting login attempts, storing secrets with appropriate mechanisms, and providing serious account recovery. The user shouldn't have to compensate with symbols for what we haven't properly planned behind the form.
Security deserves better than an impression of complexity. I'm not asking to accept just anything. I'm asking that we distinguish between a truly risky choice and a password that simply doesn't look the way the form expects.
We can protect an account without turning the login into a deciphering exercise. And to me, that's also what good site design is about.
Frankly, I can't stand it. In my daily life, I prefer a long phrase I can remember over a string of characters I have to decipher every time I log in. If it feels like you need 95 special characters just to access a site, I think we've missed the mark.
I'm not saying we should take security lightly. I'm saying a form can make our lives difficult without necessarily protecting our account any better. And as developers, I think we should ask ourselves that question before adding yet another rule.
Capital letters and symbols don't solve everything
Take an obvious password, add a capital at the start, a number and an exclamation mark at the end. The form is happy: all the boxes are ticked. But has the result become harder to guess? Not necessarily.The problem is that we can end up looking for what will satisfy the form rather than what will actually protect the account. We add the required symbol, move on, and keep a fairly predictable structure.
It's not just my personal annoyance. In its authentication guidelines, NIST, a US standards body, advises against imposing these mandatory character mixes. It specifically recommends rejecting passwords known to be too common or compromised. Password guidelines explain this distinction. It's not a universal obligation for every site, but it gives us a good reason to rethink our habits.
A long phrase must also remain unpredictable
A long, memorable phrase is what works for me. I find it more natural to remember and type than a combination of symbols forced by a form.However, "long" doesn't automatically mean "strong". A famous quote, an expected sequence of words, or a phrase containing information easily found about you doesn't become a good choice just because it fills the whole line.
Instead, I suggest looking for a combination of words that is long enough, unpredictable, and that you can remember without building it around your name or date of birth. Randomly chosen words can serve as a starting point; you can then create a mental association to memorise them. There's no need to publish that association as a hint on the account.
Length matters, but you also have to look at how the password was chosen and how the service protects it. So I'm not going to tell you that a phrase will necessarily hold up for billions of years. NIST's explanation of password strength is more useful than that kind of promise.
A good phrase shouldn't become your password for life
This is the limit to keep in mind: if you use the same phrase across multiple services, a leak on one can allow someone to try the same access on the others. It doesn't matter how easy it is to remember.So you need a different password for every account. And I readily admit that remembering a phrase for every service eventually requires a lot of effort. A password manager can help keep distinct passwords without having to memorise them all. My preference for phrases is no reason to discourage this tool.
And no, just changing the site name at the end of a common phrase is not a solution I would recommend. It quickly leads back to a predictable structure.
The password doesn't do all the work
Even a good password can be stolen if you enter it on a fake login page. Its length won't stop it from going to the wrong person.When the service allows it, I recommend enabling two-factor authentication: a second verification is added to the login. It's not an absolute guarantee, and not all methods offer the same protection, but it's a useful extra precaution. Cybermalveillance.gouv.fr explains how it works.
And if a password has been compromised, change it. That's not the same as forcing everyone to invent a new one every three months without a identified incident. I prefer a rule that responds to a risk over a constraint added to the calendar.
A quick word for my fellow devs
When we build a form, we also have a responsibility for the choices users will make. If a long phrase is rejected because it contains a space, while an obvious word with an exclamation mark is accepted, our validation deserves a closer look.Let's accept long phrases. Let password managers fill the fields and let users paste their passwords. Let's explain a rejection clearly instead of letting someone try ten random variations.
And let's work on the rest: spotting already compromised passwords, limiting login attempts, storing secrets with appropriate mechanisms, and providing serious account recovery. The user shouldn't have to compensate with symbols for what we haven't properly planned behind the form.
I want to be able to remember my password without solving a riddle
Deep down, my opinion hasn't changed: I prefer a long, memorable phrase. What annoys me is a site forcing me to distort it to meet a character list, without explaining what that achieves.Security deserves better than an impression of complexity. I'm not asking to accept just anything. I'm asking that we distinguish between a truly risky choice and a password that simply doesn't look the way the form expects.
We can protect an account without turning the login into a deciphering exercise. And to me, that's also what good site design is about.
