# The Password Game, and the rules that protect nothing

> The Password Game pushes composition rules to their absurd conclusion by demanding ever more ridiculous things. The joke is that for twenty years those rules were actual security policy.

2026-09-08 · David Carrero · password.es
Original: https://password.es/en/blog/the-password-game-and-the-rules-that-dont-protect/

---

In June 2023, a programmer named **Neal Agarwal** put something called *The
Password Game* on his site, neal.fun. It asks you to type a password. Then that it
be at least five characters. Then that it include a number. Then an uppercase
letter. Then a special character.

That part isn't a game. That's your bank's signup form.

Then the other part starts. The digits must add up to 25. It must contain the name
of a month. It must contain Roman numerals whose product is 35. It must include
today's Wordle answer. It must identify the country in a photograph. It must
contain the best move in a given chess position, in algebraic notation. There are
thirty-five rules, and along the way an egg emoji named Paul hatches inside your
password and has to be fed caterpillars, while a flame eats your characters if you
don't put it out in time.

The game works for an uncomfortable reason: **nobody has to explain the joke to
you**. You get it in the first second, because you have been living inside the
mechanism for half your life. All Agarwal did was keep pulling the thread.

And that's the part worth slowing down for. **He didn't invent the first four
rules.**

## Where the rules you already knew came from

One uppercase, one number, one symbol and a minimum length aren't internet
folklore: they are the practical translation of a US NIST document published in
**2003**, SP 800-63, written by Bill Burr. From there they trickled down into half
the world's forms, and from there into your head.

We told the whole story in [what a password is](/en/blog/what-is-a-password/):
Burr had no data on real passwords — there barely was any — so he reasoned his way
to what seemed sensible. More character variety, more combinations, more security.
In 2017 NIST itself reversed course, and Burr told the *Wall Street Journal* he
regretted much of what he had written.

So Agarwal's game doesn't exaggerate a security policy. **It continues a list that
was already wrong on line one.** The only difference between "must contain a
symbol" and "the digits must sum to 25" is that you got used to the first one.

## What those rules never measured

This is where the joke stops being funny, because it can be measured.

These figures come from this site's [checker](/en/checker/), under its stated
model: an **offline attack against a fast hash, at 10¹² guesses per second**. They
aren't brochure estimates; they are what you'll see if you type these same strings
in there.

| password | rules it satisfies | guesses | holds for |
|---|---|---|---|
| `Password1!` | all four | 20,000 | < 1 second |
| `Summer2026!` | all four | 1.0 × 10⁷ | < 1 second |
| `Zx9#kQ2m` | all four | 3.3 × 10¹⁵ | 55 minutes |
| six words rolled on dice, lowercase | **none** | 1.1 × 10²³ | 3,500 years |

That last row doesn't come from the checker, it comes from arithmetic, and that's
deliberate: the checker can't know those six words came off a die, so it would
compute something else. Six rolls are exactly 77.5 bits, and 77.5 bits at 10¹²
guesses per second is about three and a half thousand years. We'll come back to it.

Read it again. `Password1!` clears any form on the planet and falls before you let
go of the key, because the word is in the dictionary and the rest is the decoration
everyone adds: capital in front, number and symbol behind. And that last row, six
ordinary lowercase words, **would be rejected by half the sites where you have an
account**: no uppercase, no digit, no symbol.

`Zx9#kQ2m` deserves a pause, because it is the rule's best possible case. Eight
genuinely random characters with all four types — precisely what 2003 policy
considered an exemplary password. Fifty-five minutes. And that's a **ceiling**: the
checker can't know you typed it at random, so it gives you the benefit of the doubt
and computes the best case. Nobody types like that anyway. Ask a human for eight
characters with a symbol and what comes out is `Hello123!` — 45,552 guesses, under
a second.

The rule can't tell those two apart. **To the form, `Hello123!` and `Zx9#kQ2m` are
the same password.** That's the whole failure: a composition rule measures the
shape of the string, and the resistance isn't in the shape.

## The 90-day rule, or how `Autumn2026!` gets invented

The other half of the 2003 inheritance is expiry. Change it every ninety days.

Nobody invents a new password every ninety days. What people do — what you do, and
what I do — is increment the one they had. `Summer2026!` becomes `Autumn2026!` and
the job is done. Both hold for **under a second**, and if an attacker has the
first, guessing the second isn't an attack: it's filling in a blank.

NIST retired mandatory rotation in **SP 800-63B**, in 2017. In the August 2025
revision the language hardened: where it used to say verifiers *should not* impose
composition rules or require periodic changes, it now says they **shall not** do
either. A change is forced only if there's evidence the password has been
compromised.

Nine years after the first retraction, your employer still asks you for a capital
letter every quarter.

## The character limit is the worst sign of all

Agarwal has said the last straw, the thing that made him build the game, was trying
to create an account and being told his password was **too long**.

Of all the absurd rules, that's the only one that is also a bad sign.

A system that stores your password properly doesn't store it: it stores its hash,
and a hash is **always the same size**, whether you feed it eight characters or
eight hundred. There is no storage reason for a sixteen-character cap. There is
exactly one well-known legitimate technical exception — bcrypt ignores anything past
72 bytes — and it doesn't explain the forms that stop at twelve.

A short cap doesn't prove they're keeping your password in the clear, but it's the
kind of detail that only shows up when someone dropped it into a fixed-width
database column. SP 800-63B asks for the opposite: that **at least 64 characters**
be accepted.

## The rule that works doesn't fit in a form

The underlying discomfort is that good practice can't be expressed as a validation
box. Nobody can write a regular expression for "you haven't used this anywhere
else" or for "it isn't in the latest breach".

What you can do is count. A phrase of words picked **with dice** —
[Diceware](/en/blog/diceware-dice-pick-better-passwords-than-you/) — adds 12.9 clean
bits per word, and those bits really are bits. Under the same model of 10¹² guesses
per second:

- **Five words** are 64.6 bits: about **164 days**.
- **Six words** are 77.5 bits: about **3,500 years**.

Both numbers deserve saying, not just the second one. People often repeat that a
five-word phrase "lasts for centuries", and against a fast hash it doesn't last for
centuries: it lasts five and a half months. That's why Reinhold recommended five as
a floor and six for anything that matters. **Word number six is the one that
changes the scale**, and it's free.

Neither of the two would pass your bank's form.

## Why the game is funny

When the game demands that your digits sum to 25, you laugh because it's an
arbitrary condition with nothing to do with what makes a password secure.

Demanding a symbol is also an arbitrary condition with nothing to do with what makes
a password secure. The difference is that half the internet ships that one, and that
we've grown fond of it.

If you want the operational summary, it fits in three lines: use the
[generator](/en/) or a set of dice, put the result in your manager, and satisfy the
form's rules by **appending** whatever it asks for, without believing that protected
you from anything. The capital in front and the `!` at the end are a toll, not a
defence.

The rest is a game. It's beautifully made, and it's a shame it didn't stay one.

---

*Sources: Neal Agarwal, "The Password Game" (neal.fun, 27 June 2023), its 35 rules
and the author's own account of the form that told him his password was too long ·
NIST SP 800-63 (2003), SP 800-63B (2017) and SP 800-63B-4 (August 2025), which moves
from "should not" to "shall not" on composition rules and expiry, and asks that at
least 64 characters be accepted · Bill Burr's statements to the Wall Street Journal,
August 2017 · Arnold G. Reinhold, Diceware (1995), the source of the 12.9 bits per
word. The times in the table are measured with this site's checker under its stated
model of 10¹² guesses per second against a fast hash; the Diceware figures are
computed at the same rate from log₂(7,776) per word.*