This is an opinion piece. The views are the author’s own.
You know the drill. A website demands “at least one uppercase letter, one number and one special character,” caps the length at some oddly small number, refuses to let you paste from your password manager and, three months later, makes you change the whole thing anyway.
Every part of that experience is wrong. And I don’t just mean annoying. I mean it goes against the official advice.
The Rulebook Changed. The Websites Didn’t.
The National Institute of Standards and Technology (NIST) writes the federal government’s digital identity guidelines, and plenty of companies treat them as the gold standard. The current version, finalized in August 2025, is blunt. Systems “SHALL NOT” impose composition rules like mixing character types. They “SHALL NOT” force people to change passwords on a schedule; a change is required only when there’s evidence the password was compromised. They also shall not prompt people to set up security questions when choosing a password, or let them store password hints.
What NIST wants instead is sensible: allow long passwords (at least 64 characters), require a minimum of 15 characters when the password is the only thing protecting the account, check new passwords against lists of common and leaked ones, and let people use password managers and autofill. It also says sites should let you paste.
Why the Old Rules Backfire
Composition rules don’t make people creative. They make them predictable. “Summer2026!” ticks every box and is about as secret as the weather. Forced resets every 90 days get you “Summer2026!!” and then “Fall2026!”. Short maximum lengths punish the people doing the right thing with long passphrases. Blocking paste punishes the people using password managers, which is to say, the people with the best passwords.
Security questions are worse still. My mother’s maiden name and the street I grew up on are not secrets. They are the kind of thing anyone could dig up.
What I’d Like Instead
If you run a website, read the guideline, delete the clever rules and add a check against breached passwords. Better yet, offer passkeys, which skip the whole mess. (If you haven’t tried one, our guide on setting up a passkey for your Google account shows how painless it is.)
If you’re a user stuck with a site that still lives in 2005: use a password manager, let it generate something long, and grit your teeth through the symbol requirement. It’s not your fault. It’s theirs.
More on Contoh
- How to Set Up a Passkey for Your Google Account
- How to Turn On Stolen Device Protection on Your iPhone
- How to Freeze Your Credit (and Unfreeze It When You Need To)