Password policy research shows most major sites still miss best practice

At a glance

What this is: This is a summary of Princeton University’s study of password policies across 120 popular English-language websites, which found only 15 met the researchers’ best-practice test.

Why it matters: It matters because password policy remains a front-line IAM control, and weak composition rules or excessive friction can push users toward insecure behaviour that increases breach exposure.

By the numbers:

• Only 15 of 120 popular English-language websites met the researchers’ password policy best-practice test.

Context

Password policy is the set of rules a website uses to help people create, use, and recover passwords. In this study, the key question was not whether sites had a password policy, but whether those policies balanced security and usability in ways that actually reduce risk.

Princeton University researchers reverse-engineered password policies on 120 of the most popular English-language websites and measured them against long-established best practices. The result was stark: most sites still fail on one or more basics, which suggests password governance remains inconsistent even among high-traffic services.

For IAM teams, the finding is less about passwords as a legacy mechanism and more about control design. If the policy pushes users toward predictable, hard-to-manage credentials, the organisation inherits both weak authentication and avoidable support and recovery burden.

Key questions

Q: What breaks when password policies rely on rigid character requirements?

A: Rigid character requirements often produce predictable user workarounds, such as adding the same symbol or number pattern to every password. The result is a policy that appears strict but does not materially improve guess resistance. Teams should prefer length, blocklists, and strength checks that align with how attackers actually test credentials.

Q: Why do password policies still matter in organisations using MFA?

A: Passwords still matter because MFA reduces but does not eliminate credential compromise risk. Weak or reused passwords can still be phished, sprayed, stolen from adjacent systems, or used in recovery flows. A strong password policy remains useful because it limits how easily an attacker can start or sustain an account takeover attempt.

Q: How do IAM teams know whether passwordless adoption is actually working?

A: They should look for fewer lockouts, fewer reset requests, shorter time to access, and lower dependence on help desk intervention. Adoption is only successful if the new method is secure and easier for employees to use than the old one. Metrics should show both improved assurance and reduced operational drag.

Q: When should organisations prioritise password length over composition complexity?

A: Always, if the goal is actual resistance to cracking. Length expands the search space far more effectively than adding a symbol or capital letter. Once a sensible minimum length is in place, organisations should prioritise breach-corpus exclusion and password uniqueness before they worry about character-class variety.

Technical breakdown

Why password blocklists and length rules matter

Password blocklists stop users from choosing credentials that are already widely known or trivially guessed, while length requirements or accurate strength meters raise the effort needed for offline or online guessing attacks. The research used both controls together because either one alone can be undermined by poor policy design. A good password policy is not simply strict; it should make weak choices inconvenient without making strong choices difficult. The study’s criteria reflect a basic security principle: users should be guided toward passwords that resist common credential-stuffing and guess-based attacks, not forced into patterns attackers can predict.

Practical implication: review whether your password policy blocks common leaked passwords and measures strength in a way that reflects real attack resistance.

Why character-class rules often create false security

Character-class rules such as forcing at least one digit and one symbol often improve appearance more than actual security. Users respond by making predictable substitutions, adding the same symbol at the end, or creating patterns that satisfy the rule but remain easy to guess. The Princeton study treated this as a usability failure because security controls that people work around rarely produce durable protection. From an IAM perspective, the policy objective should be resistance to guessing, not compliance theatre. That is why modern guidance often prefers length, blocklists, and strength meters over rigid composition checkboxes.

Practical implication: remove rigid composition rules where they do not materially improve guess resistance and replace them with controls that measure strength more meaningfully.

How password policy becomes an identity governance issue

Password policy is not just an authentication setting. It shapes help desk load, reset frequency, account recovery behaviour, and the likelihood that users reuse weak credentials across services. In practice, that means password policy influences the reliability of the entire human identity lifecycle. The Bitwarden summary notes that strong and complex passwords remain a basic defensive measure, but the governance question is whether the organisation makes good behaviour easy enough to sustain. If policy creates friction, users often compensate in ways that expand risk rather than reduce it.

Practical implication: treat password policy as part of identity governance, not an isolated login configuration.

NHI Mgmt Group analysis

Password policy is an access governance control, not a formatting preference. The Princeton study shows that many major websites still treat password creation as a user-experience detail when it is really a security control shaping authentication quality. If policy allows weak choices or forces brittle composition rules, the identity programme is governing behaviour poorly. The practitioner conclusion is straightforward: password policy should be measured against attack resistance, not administrative convenience.

Usability and security are not opposing goals in password policy. The study’s best-practice test combined blocklists, minimum length or strength meters, and the absence of rigid character-class demands because those elements work together. Overly prescriptive rules often create predictable user workarounds that undermine the stated control objective. The implication for practitioners is to design policy that people can actually follow without reducing entropy in practice.

Authentication failure remains a governance problem because the policy layer often creates the failure conditions. The peer-reviewed paper cited by Bitwarden notes that close to half of data breaches involved authentication failures. That does not mean passwords are obsolete; it means weak password policy still sits upstream of many compromises. Practitioners should treat policy design as part of breach reduction, not merely account setup.

Strong password guidance loses value when the organisation makes good behaviour hard. This is the central programme lesson from the study. If sites insist on awkward composition rules, users will optimise for compliance, not resilience, and the organisation absorbs the downstream cost in resets, reuse, and weaker credential choices. The conclusion for IAM leads is to align policy with how people actually create and manage passwords at scale.

Credential quality is a lifecycle issue because creation, recovery, and reset are linked. The article’s banking-edition example makes the operational point visible: password length limits, paste support, and reset flows all affect whether users can sustain stronger credentials. That is why password governance belongs in the same conversation as identity lifecycle management. Practitioners should manage the full credential journey, not just initial creation.

What this signals

Password policy is still a governance control that shapes authentication quality at scale. The study suggests that many organisations still optimise for rule enforcement instead of attack resistance, which can leave users with passwords that are easy to manage but also easy to guess. IAM teams should treat policy design, recovery design, and support burden as one control surface, not separate problems.

Strong password guidance works best when it removes predictable friction. If users can paste passwords, avoid arbitrary character-class rules, and rely on meaningful strength checks, they are more likely to create credentials that hold up under real attack conditions. That is a practical identity governance improvement, not just a usability tweak.

For practitioners

• Audit password policy against attack resistance Check whether current rules allow common leaked passwords, require reasonable minimum length, and rely on strength meters that reflect adversary guessing risk rather than cosmetic complexity.
• Remove brittle character-class requirements Replace mandatory digits, symbols, and mixed-case patterns with controls that improve actual guess resistance and reduce the predictable workarounds users adopt.
• Review password reset and recovery flows Make sure resets do not undo stronger password policy by allowing weak replacement credentials or confusing user verification steps that encourage reuse.
• Measure the help desk impact of password friction Track how often password policy drives support contacts, forgotten credentials, or repeated reset requests, then use that evidence to justify policy redesign.

Key takeaways

• Most major websites still fall short of password policy best practice, showing that weak guidance remains common even among high-traffic services.
• The article reinforces that password policy affects both security outcomes and user behaviour, so poor design can increase risk rather than reduce it.
• IAM teams should focus on length, blocklists, and usable strength controls, then align recovery and reset flows with the same standard.

Key terms

• Password Policy Template: A password policy template is a predefined configuration that standardises acceptable password rules across users or groups. It helps teams avoid one-off exceptions, reduce configuration drift, and make enforcement easier to maintain in environments where manual policy design does not scale.
• Password Blocklist: A password blocklist is a rejected list of common, leaked, or easily guessed passwords that users are prevented from choosing. In practice, it is a direct control against predictable credential selection and is more effective than forcing arbitrary character patterns that do not change guessability.
• Password Strength Meter: A password strength meter is a user-facing indicator that estimates how resistant a chosen password is to being guessed. The useful version measures actual guessability, not just character variety, and helps users make better choices without relying on brittle composition rules.
• Character-class Requirement: A character-class requirement forces passwords to include elements such as digits, symbols, or uppercase letters. These rules often improve appearance more than security, because users tend to satisfy them with predictable patterns that attackers can learn and exploit.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.