Topic starter
09/07/2026 3:21 pm
TL;DR: Princeton University researchers found only 15 of 120 popular English-language websites met their password policy best-practice test, showing that weak password rules and usability trade-offs remain widespread across high-traffic services, according to Bitwarden’s summary of the study. Stronger password guidance still matters because authentication failure remains a major breach pathway, but organisations must remove policy friction that drives poor user behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Bitwarden: “Princeton Grades Password Policies of Most Popular Websites”.
Key questions
Q: What breaks when password policies rely on rigid character requirements?
A: Rigid character requirements often produce predictable user workarounds, such as adding the same symbol or number pattern to every password.
Q: Why do password policies still matter in organisations using MFA?
A: Passwords still matter because MFA reduces but does not eliminate credential compromise risk.
Q: How do IAM teams know whether passwordless adoption is actually working?
A: They should look for fewer lockouts, fewer reset requests, shorter time to access, and lower dependence on help desk intervention.
Practitioner guidance
- Audit password policy against attack resistance Check whether current rules allow common leaked passwords, require reasonable minimum length, and rely on strength meters that reflect adversary guessing risk rather than cosmetic complexity.
- Remove brittle character-class requirements Replace mandatory digits, symbols, and mixed-case patterns with controls that improve actual guess resistance and reduce the predictable workarounds users adopt.
- Review password reset and recovery flows Make sure resets do not undo stronger password policy by allowing weak replacement credentials or confusing user verification steps that encourage reuse.
Bottom line: Most major websites still fall short of password policy best practice, showing that weak guidance remains common even among high-traffic services.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:39 pm
Password policy is an access governance control, not a formatting preference. The Princeton study shows that many major websites still treat password creation as a user-experience detail when it is really a security control shaping authentication quality. If policy allows weak choices or forces brittle composition rules, the identity programme is governing behaviour poorly. The practitioner conclusion is straightforward: password policy should be measured against attack resistance, not administrative convenience.
A question worth separating out:
Q: When should organisations prioritise password length over composition complexity?
A: Always, if the goal is actual resistance to cracking. Length expands the search space far more effectively than adding a symbol or capital letter. Once a sensible minimum length is in place, organisations should prioritise breach-corpus exclusion and password uniqueness before they worry about character-class variety.
👉 Read our full editorial: Password policy research shows most major sites still miss best practice