Part 1 of 4
Who decided passwords need a capital, a number, and a symbol?
A government guideline and the credit-card industry, but the guideline’s co-author later regretted it.
Bill Burr was a co-author of a 2004 US government guideline whose appendix on password strength helped turn the demand for capital letters, numbers, and symbols into a standard requirement. Thirteen years later he told the Wall Street Journal, “Much of what I did I now regret.”
The idea was older: Unix’s designers had nudged people toward a wider mix of characters in 1979. And the same year as Burr’s guideline, the credit-card industry required every business handling card data to use passwords with “both numeric and alphabetic characters.”
In 2017 the government began taking it back, advising that services “should not” demand mixtures of character types and requiring new passwords to be checked against lists of common and leaked ones. The current guidance, published in 2025, goes further: services “shall not” demand those mixtures or periodic changes, and passwords used on their own must be at least fifteen characters long.
- Source: NIST SP 800-63 v1.0, Electronic Authentication Guideline (June 2004), Appendix A
- Source: BizTech, "Password Rule Guru Bill Burr Now Regrets His Advice" (2017)
- Source: Robert Morris & Ken Thompson, "Password Security: A Case History" (1979)
- Source: Payment Card Industry Data Security Standard, Version 1.0 (December 2004), requirement 8.5.9 (archived copy)
- Source: NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management (June 2017)
- Source: NIST SP 800-63B-4, Digital Identity Guidelines: Authentication (2025)