Password Rules and Protection

A system can enforce password rules before it accepts a new password. Rules commonly set a minimum length and require a mix of character types, such as uppercase letters, lowercase letters, digits and symbols. The system checks the password as you create it and refuses any that does not meet the rules, so you cannot choose a very short or simple password.

For example, a ticket-booking account might ask for at least 12 characters, including a digit and a symbol. If you type only lowercase letters, the system rejects it and asks you to try again. A longer, more varied password makes a brute-force attack impractical, because there are far more combinations to try before one works.

Forcing a new password

A system can also force a user to set a new password. This happens when a password is known to have leaked: the old one stops working and you must choose a different one at your next login. It also happens when a default password is still in use. Devices such as routers often arrive with the same starting password for every unit, so setup can make you replace it before the device can be used.

Protecting stored and sent passwords

The system must protect passwords as well as the user. Stored passwords are not kept as plain text; they are reduced to a hash, a scrambled value that cannot easily be turned back into the password, so someone who opens the password file still cannot read them. When a password is sent, it travels over an encrypted connection, so an intercepted copy is unreadable.

All of these measures make unauthorised access harder, but they do not stop every threat: a phishing email can still trick you into typing your password into a fake page, and malware can still capture what you type.