Why a website rejects your strong password

A site can reject a strong password because its rules are about format, not strength. Common reasons are a maximum length, symbols it does not allow, a missing required character type, or a match against lists of leaked passwords. Read the exact rule, then generate a password that fits it instead of weakening yours by guesswork.

The rules that trip people up

• Maximum length. Some sites cap passwords at 16, 20 or 32 characters. A 30-character password from a manager fails without a clear message.
• Allowed symbols. Systems may refuse quotes, angle brackets, spaces, backslashes or anything outside a short list such as ! @ # $ %.
• Required character types. “At least one upper-case letter, one number and one symbol”. A long random password can, by chance, lack one of them.
• Starting or ending rules. Some systems refuse a password that starts with a symbol or a number, or ends with a space.
• Breached password checks. Some sites compare new passwords against lists of passwords exposed in data breaches. Anything found is rejected, however complex it looks.
• Similarity checks. Passwords containing your name, email or username, or too close to the previous one, can be refused.
• Silent truncation. The worst case: an older system quietly cuts the password at a fixed length when you set it, then compares the full version at login. If a new password works once and then fails, try only its first part to confirm, then change it to one under the limit.

Find the rule

1. Look under the password box for the full rule list; some forms show it only after an error.
2. Check the site’s help pages for “password requirements”.
3. If there is no information, test methodically: try 16 characters of letters and numbers only. If that works, add symbols; if it does not, the issue is length or a required type.

Generate a password that fits

The Password Generator lets you set the length and switch off symbols, numbers or either case, or exclude look-alike characters. Passwords are made by your browser’s cryptographic random number generator and never sent anywhere. If symbols are restricted, make up for it with length: 20 random letters and digits are far stronger than 12 characters with a symbol.

If a site insists on at least one of each type and the generated password lacks one, generate again rather than editing it by hand — your edits are less random than the generator.

Check strength honestly

A site’s green bar measures its own rules. The Password Strength Checker estimates how long a password would take to crack and flags patterns such as dictionary words, dates and keyboard runs. It runs in your browser and does not send the password anywhere, which also means it does not check breach lists.

When the error message is vague

“Invalid password” without detail often means a rule the form does not show. Paste the password into a plain text field first to check that the password manager or clipboard did not add a trailing space or line break, a frequent invisible cause. If you are changing a password, also check the new one was not used recently on the same account; many systems refuse reuse.

What not to do

• Shortening a strong password to a memorable word plus “1!” to get past the rules.
• Reusing a password that another site accepted.
• Emailing yourself the password to “remember” it; use a password manager.

A note on passphrases

Several random words — for example four or five chosen by a generator — are easy to type and strong. Many sites accept them; if spaces are refused, join the words with hyphens. If a maximum length makes a passphrase impossible, switch to a random character password at the maximum length allowed.

Checklist

• Full password rules read, including maximum length?
• Generated, not edited by hand?
• Unique to this site and stored in a password manager?
• Tested by logging out and in again straight away?