Password criteria example

How it works

A site’s password form is a gate. It checks the candidate against the rules that site wrote: a minimum length, sometimes a maximum, required kinds of characters, and a list of things it will refuse — spaces, the username, a short dictionary, a previous password. The form accepts or rejects. It does not know whether you reused the string on another site. It does not know whether the string is a famous phrase with a year glued on. Acceptance is a match to the gate, not a laboratory of strength.

This page walks a sample gate so you can see the difference between “the form is pleased” and “the secret is scarce.” The sample is not a law, not a company’s policy, and not a substitute for the rules on the site you are actually joining. When a live form disagrees with this sample, the live form wins for that account. Read that form. Do not argue with it from a tutorial.

A generator can emit a mixed string that sails through a fussy gate. A checker can score a string you already have. Criteria sit in the middle: they are the written test. Use them to understand a rejection. Do not paste a live login into a strange page that offers to “validate” it on a server you cannot name. Length and uniqueness do more of the real work than class marks; if a form still demands those marks, set them in the generator, save the result, and stop memorizing a variant of an old phrase.

A sample rule set and strings that pass or fail

Suppose a form states all of the following: at least twelve characters; at least one lowercase letter; at least one uppercase letter; at least one digit; at least one character that is not a letter or a digit; no spaces; the username is forbidden. That is a sample, labeled as a sample, so we can test it in public without pretending it is every bank.

short7A! — fails length. alllowercaseword1! — fails the uppercase requirement in this sample. NoDigitMark — fails the digit requirement in this sample. WinterYear! — may pass the classes and still be a season-shaped guess if the year is the obvious one; the sample gate cannot hear that.

A long mixed string from a password manager — passes this sample if it meets length and classes and contains no space; store it, do not recite it. The fourth item is the lesson the gate will not print. A season-year-mark pattern is easy to type and easy to try. The form sees mix. If you need a secret, let a generator pick every position, then let a manager remember it. Some forms also reject strings that appeared in known dumps. That check is a leak test, not a mix test. A unique long string can still be burned if it was stolen from a sick computer. A common word that has never been in a dump is still a poor secret. Read which test rejected you.

Passing the form is not a vault

Criteria will not store the string. They will not type it on the real domain. They will not stop you pasting the same winner into twenty sites. Uniqueness is a habit the gate does not measure. A manager that keeps a different secret per site is the tool for that habit. The example on this page is only a walkthrough of a gate.

A season, a year, and an exclamation mark can please a fussy form and still behave like a calendar. The form cannot hear the calendar. Do not put your real login into this explanation. Type dummy strings here. On a live account, use the site’s own form on a machine you trust, and save the accepted string in a vault you already use. Odd rules — a tiny maximum length, banned punctuation — are a defect you live with for that one entry, not a reason to reuse a memorable phrase everywhere else. When two sites disagree, they are two gates. There is a unique string per gate, stored, and a master password you can remember for the vault.