Every annoying password rule you follow, the capital letter, the number, the symbol, changing it every few months, came from one man at a US government office in 2003. He was mostly guessing. Years later, he went public and apologized to all of us.
The password is older than that rule, and it was a mess from day one. It was born at MIT in 1961, when a scientist named Fernando Corbató built one of the first computers many people could share at once. Since everyone shared that one machine, he needed to keep each person's files separate. His fix was the password. He never meant it as serious security, just to stop casual snooping.
It didn't even do that much. Every password sat in one plain file anyone with access could read. In the spring of 1962, an MIT student named Allan Scherr hit his four-hour-a-week limit and wanted more. One Friday night he asked the system to print that file, then grabbed the whole list Saturday morning. He logged in as other people and passed the list around to friends. The password was about a year old, and it was already broken.
The man behind the rules you hate was Bill Burr, and in 2003 he wrote an eight page guide on building a password. He told everyone to add a capital letter, a number, and a symbol, and to switch to a new one every 90 days. Banks, schools, and offices copied it word for word. That is why your login still wants a symbol and a number you can't recall. He had almost no proof any of it worked. He leaned on a paper from the 1980s, before the internet existed, when almost no one had studied what made a password safe.
In 2017, he came clean. He told the Wall Street Journal, "Much of what I did I now regret." Forcing a new password every few months just taught the lazy move, bumping Rosebud1 to Rosebud2 to Rosebud3, which a computer cracks in seconds. So the same office threw the rules out. The new advice is to skip the symbols and forced changes and use a long, plain phrase. A cartoonist named Randall Munroe ran the numbers. A phrase like "correct horse battery staple" would take a computer about 550 years to crack, while a rules-style password like "Tr0ub4dor&3" falls in three days.
People have leaned on spoken passwords for roughly 3,000 years. Roman soldiers had a code word for the night guard, and during Prohibition you needed the right phrase to get into the bar. But there was only ever one of them, just for that night. The same brain that once held a single code word now has to track 120 of them, each with a capital and a symbol, half guarding accounts you forgot you ever made. So no, the human spirit was not built for this. One man's shaky guess in 2003 just made it hurt a whole lot more.
the human spirit was not designed for this many passwords