Password Requirements Examples

What is a special character in a password?

A special character is usually punctuation or another non-letter, non-number symbol. Common examples include !, @, #, $, %, ^, &, *, -, _, +, and =. A website may accept only part of that set, so its displayed allowed-character list takes priority.

“At least one special character” means one or more accepted symbols may appear anywhere in the password. It does not mean that adding ! to a familiar word automatically makes that password unpredictable. Use the special-character password generator when you need to choose the exact allowed symbols.

Uppercase and lowercase password example

Uppercase letters are A–Z; lowercase letters are a–z. A rule requiring both categories could be satisfied by a structure such as [uppercase][lowercase letters]. The public demonstration DemoOnlyAa contains both, but it should not be used as a credential.

If the password is case-sensitive, A and a are different characters. Changing the capitalization changes the password. Most modern password systems are case-sensitive even when usernames are not.

Alphanumeric password example

Alphanumeric means letters and numbers. It normally excludes spaces and punctuation unless the service separately says those are allowed. A requirement such as “6–12 alphanumeric characters” asks for a total length from 6 through 12 using only the permitted letters and digits.

The alphanumeric password generator creates fresh letters-and-numbers-only values and supports custom lengths. Do not assume that “alphanumeric” automatically requires uppercase and lowercase; check whether the form names those categories separately.

How to read password length ranges

A rule such as “8 to 16 characters” normally includes both endpoints: 8, 9, 10, and every length through 16 are accepted. Count every character, including punctuation and spaces when spaces are permitted. An 8-character result is not eight letters plus required numbers and symbols; all characters together must total eight.

Choose the longest random result the destination accepts, especially when software will save and autofill it. Exact-length tools are available for 8 characters, 12 characters, and 16 characters.

“Password must contain at least one character and one number”

Forms sometimes use “character” imprecisely when they mean a letter. Read the nearby checklist or validation message. If it says “at least one letter and one number,” a valid structure is [letter][additional allowed characters][digit]. If it says “one uppercase, one lowercase, one number, and one special character,” all four categories must appear within the total length.

A generator should place required categories randomly rather than always capitalizing the first character and adding 1! at the end. The password example generator creates fresh examples for the major formats.

What are valid password characters?

Valid characters are the exact characters a particular service accepts. A site may allow all printable ASCII characters, spaces, or Unicode; another may reject spaces, quotes, slashes, non-ASCII letters, or selected symbols because of legacy software. There is no universal special-character list that works everywhere.

If the rule lists permitted symbols, use only that list. If it lists forbidden characters, exclude them. Never assume that an error means your password is too weak: it may be long enough but contain one unsupported character.

Why does a password not meet the requirements?

Check the message in this order:

1. Count the total length and confirm it falls within the stated range.
2. Confirm every required category appears at least once.
3. Look for a disallowed space, symbol, accented letter, or emoji.
4. Check whether the new password matches an old password or contains the username or service name.
5. Try a newly generated value rather than repeatedly modifying the rejected one.

If the service gives only a generic error, its support documentation is the authoritative source for that specific account.

Current guidance versus website composition rules

Many websites still require mixtures of uppercase letters, lowercase letters, numbers, and symbols. This guide helps you satisfy those real compatibility rules. However, current NIST SP 800-63B guidance tells verifiers not to impose composition rules and instead emphasizes length, blocking common or compromised passwords, accepting password-manager workflows, and permitting a broad character set.

NIST currently requires at least 15 characters when a password is used as a single authentication factor, permits a minimum of 8 when it is part of multifactor authentication, recommends allowing at least 64 characters, and says passwords should not be changed periodically without evidence of compromise. Those are recommendations for systems and do not override the requirements shown by the account you are creating.

Sources and review scope

Standards and guidance were reviewed on September 27, 2026. Individual services can impose different limits, so always follow the current message and official documentation for the destination.

• NIST SP 800-63B: Password authenticator requirements
• NIST SP 800-63B: Strength of Passwords
• OWASP Authentication Cheat Sheet