Password Game

Features

• Twelve escalating rules
• Live validation as you type
• Best-level tracking saved on your device
• Explains which rules are genuinely useful
• Nothing is transmitted or stored beyond your best score

How to use it

1. Start typing to reveal the first rule.
2. Satisfy every visible rule to unlock the next.
3. Notice which rules make the password worse.
4. Read the notes below when you get stuck.

Which of these rules are real security

Composition rules, requiring an uppercase letter, a digit and a symbol, are the classic example of security theatre. NIST formally recommended against them in Special Publication 800-63B, because they produce predictable results: told to add a capital and a number, people overwhelmingly produce Password1!. The rule adds almost no entropy while making passwords harder to remember, which pushes people toward reuse and writing them down.

Length is the rule that genuinely works, and it works better than everything else combined. Each additional character multiplies the search space, so a long passphrase of common words beats a short string of symbols by an enormous margin. NIST's current guidance is to require a minimum of 8 characters, permit at least 64, allow all printable characters including spaces, and impose no composition rules at all.

Two more real measures. Checking new passwords against lists of known breached credentials catches the passwords attackers actually try first, which no composition rule does. And forced periodic expiry, the 90-day rotation policy many organisations still run, was also withdrawn by NIST, because it drives predictable incrementing (Spring2024, then Summer2024) and offers no benefit unless there is evidence of compromise. If a site imposes rules like the sillier ones in this game, that tells you something about how much thought went into the rest of its security.