The Password Game, and the rules that protect nothing

In June 2023, a programmer named Neal Agarwal put something called The Password Game on his site, neal.fun. It asks you to type a password. Then that it be at least five characters. Then that it include a number. Then an uppercase letter. Then a special character.

That part isn’t a game. That’s your bank’s signup form.

Then the other part starts. The digits must add up to 25. It must contain the name of a month. It must contain Roman numerals whose product is 35. It must include today’s Wordle answer. It must identify the country in a photograph. It must contain the best move in a given chess position, in algebraic notation. There are thirty-five rules, and along the way an egg emoji named Paul hatches inside your password and has to be fed caterpillars, while a flame eats your characters if you don’t put it out in time.

The game works for an uncomfortable reason: nobody has to explain the joke to you. You get it in the first second, because you have been living inside the mechanism for half your life. All Agarwal did was keep pulling the thread.

And that’s the part worth slowing down for. He didn’t invent the first four rules.

Where the rules you already knew came from

One uppercase, one number, one symbol and a minimum length aren’t internet folklore: they are the practical translation of a US NIST document published in 2003, SP 800-63, written by Bill Burr. From there they trickled down into half the world’s forms, and from there into your head.

We told the whole story in what a password is: Burr had no data on real passwords — there barely was any — so he reasoned his way to what seemed sensible. More character variety, more combinations, more security. In 2017 NIST itself reversed course, and Burr told the Wall Street Journal he regretted much of what he had written.

So Agarwal’s game doesn’t exaggerate a security policy. It continues a list that was already wrong on line one. The only difference between “must contain a symbol” and “the digits must sum to 25” is that you got used to the first one.

What those rules never measured

This is where the joke stops being funny, because it can be measured.

These figures come from this site’s checker, under its stated model: an offline attack against a fast hash, at 10¹² guesses per second. They aren’t brochure estimates; they are what you’ll see if you type these same strings in there.

That last row doesn’t come from the checker, it comes from arithmetic, and that’s deliberate: the checker can’t know those six words came off a die, so it would compute something else. Six rolls are exactly 77.5 bits, and 77.5 bits at 10¹² guesses per second is about three and a half thousand years. We’ll come back to it.

Read it again. Password1! clears any form on the planet and falls before you let go of the key, because the word is in the dictionary and the rest is the decoration everyone adds: capital in front, number and symbol behind. And that last row, six ordinary lowercase words, would be rejected by half the sites where you have an account: no uppercase, no digit, no symbol.

Zx9#kQ2m deserves a pause, because it is the rule’s best possible case. Eight genuinely random characters with all four types — precisely what 2003 policy considered an exemplary password. Fifty-five minutes. And that’s a ceiling: the checker can’t know you typed it at random, so it gives you the benefit of the doubt and computes the best case. Nobody types like that anyway. Ask a human for eight characters with a symbol and what comes out is Hello123! — 45,552 guesses, under a second.

The rule can’t tell those two apart. To the form, Hello123! and Zx9#kQ2m are the same password. That’s the whole failure: a composition rule measures the shape of the string, and the resistance isn’t in the shape.

The 90-day rule, or how Autumn2026! gets invented

The other half of the 2003 inheritance is expiry. Change it every ninety days.

Nobody invents a new password every ninety days. What people do — what you do, and what I do — is increment the one they had. Summer2026! becomes Autumn2026! and the job is done. Both hold for under a second, and if an attacker has the first, guessing the second isn’t an attack: it’s filling in a blank.

NIST retired mandatory rotation in SP 800-63B, in 2017. In the August 2025 revision the language hardened: where it used to say verifiers should not impose composition rules or require periodic changes, it now says they shall not do either. A change is forced only if there’s evidence the password has been compromised.

Nine years after the first retraction, your employer still asks you for a capital letter every quarter.

The character limit is the worst sign of all

Agarwal has said the last straw, the thing that made him build the game, was trying to create an account and being told his password was too long.

Of all the absurd rules, that’s the only one that is also a bad sign.

A system that stores your password properly doesn’t store it: it stores its hash, and a hash is always the same size, whether you feed it eight characters or eight hundred. There is no storage reason for a sixteen-character cap. There is exactly one well-known legitimate technical exception — bcrypt ignores anything past 72 bytes — and it doesn’t explain the forms that stop at twelve.

A short cap doesn’t prove they’re keeping your password in the clear, but it’s the kind of detail that only shows up when someone dropped it into a fixed-width database column. SP 800-63B asks for the opposite: that at least 64 characters be accepted.

The rule that works doesn’t fit in a form

The underlying discomfort is that good practice can’t be expressed as a validation box. Nobody can write a regular expression for “you haven’t used this anywhere else” or for “it isn’t in the latest breach”.

What you can do is count. A phrase of words picked with dice — Diceware — adds 12.9 clean bits per word, and those bits really are bits. Under the same model of 10¹² guesses per second:

• Five words are 64.6 bits: about 164 days.
• Six words are 77.5 bits: about 3,500 years.

Both numbers deserve saying, not just the second one. People often repeat that a five-word phrase “lasts for centuries”, and against a fast hash it doesn’t last for centuries: it lasts five and a half months. That’s why Reinhold recommended five as a floor and six for anything that matters. Word number six is the one that changes the scale, and it’s free.

Neither of the two would pass your bank’s form.

Why the game is funny

When the game demands that your digits sum to 25, you laugh because it’s an arbitrary condition with nothing to do with what makes a password secure.

Demanding a symbol is also an arbitrary condition with nothing to do with what makes a password secure. The difference is that half the internet ships that one, and that we’ve grown fond of it.

If you want the operational summary, it fits in three lines: use the generator or a set of dice, put the result in your manager, and satisfy the form’s rules by appending whatever it asks for, without believing that protected you from anything. The capital in front and the ! at the end are a toll, not a defence.

The rest is a game. It’s beautifully made, and it’s a shame it didn’t stay one.

Sources: Neal Agarwal, “The Password Game” (neal.fun, 27 June 2023), its 35 rules and the author’s own account of the form that told him his password was too long · NIST SP 800-63 (2003), SP 800-63B (2017) and SP 800-63B-4 (August 2025), which moves from “should not” to “shall not” on composition rules and expiry, and asks that at least 64 characters be accepted · Bill Burr’s statements to the Wall Street Journal, August 2017 · Arnold G. Reinhold, Diceware (1995), the source of the 12.9 bits per word. The times in the table are measured with this site’s checker under its stated model of 10¹² guesses per second against a fast hash; the Diceware figures are computed at the same rate from log₂(7,776) per word.

Photo by Olha Ruskykh · Pexels

← Back to the blog