A Website Won't Accept My Password: How to Fix It

When a website will not accept your password, the cause is almost always one of five site rules: a minimum or maximum length, a blocked special character, a required type of character, a ban on spaces, or a character that got pasted by accident. Find the rule the form is applying, then make a new password that fits it. A generator with options for length, symbols and separators fixes most cases in seconds.

Below is a quick lookup table, followed by a closer look at each problem and why it happens.

What does the error message mean, and what fixes it?

Read the message under the password field, then find the closest match here. The last column names the setting to change in our password generator.

If the form gives a number, such as a maximum of 20, count the characters in the password you tried. A space copied at the start or end counts too, and it is easy to miss.

Why is a password with special characters not accepted?

This is the most common surprise. A site may block a few symbols or all of them, and the message rarely says which. There is no universal list of allowed special characters, because each site sets its own password requirements.

The dependable fix is to untick Symbols (!@#$) and generate again. A password made of uppercase letters, lowercase letters and numbers is accepted almost everywhere. Because the pool of characters is smaller, add a few characters of length to make up for it. The generator's strength label updates as you change the length, so you can see the effect.

Why does a site say my password is too long?

Most forms set a minimum length, and some also set a maximum. These limits come from the site, not from you. We cannot know the reason for any particular site; often it is down to an older system or the way a form was built rather than a security decision.

Published security guidance from bodies such as NIST and OWASP recommends the opposite: that sites accept long passwords and passphrases and allow a wide range of characters. Until a site follows that advice, lower the length to fit its maximum. The generator accepts any length from 4 to 128 characters, so you can match the range the form asks for.

Why does it insist on uppercase, lowercase, a number and a symbol?

Some sites use composition rules: the password must contain one character from each type. A password you invent by hand often misses one without you noticing.

When you select uppercase, lowercase, numbers and symbols in the generator, every selected set appears at least once in the result. If the form requires a symbol but rejects the one you got, generate again; a different symbol may be accepted. If it keeps failing, the form probably allows only a few symbols, and its help text or small print may list them.

Whether those mixed character types add more strength than extra length is a question of its own, explained in password length vs complexity.

What if the password worked once but fails at sign-in?

This is usually about spaces or hidden characters. Some forms quietly trim a space from the start or end when you sign up, and then compare it exactly when you sign in, or the other way round.

• If you use a passphrase, switch the separator from Space to Hyphen (-) or None, so there is nothing to trim.
• If you pasted the password, paste it into a character counter first. If the count is one higher than you expect, a space or line break came along.
• If you typed it on a phone, check that the keyboard did not capitalise the first letter for you.

Which characters are hard to read or type?

If you must type a password on a TV, a game console or a shared device, characters such as O and 0, or l, 1 and I, are easy to confuse. Tick Exclude look-alike characters and the generator leaves out all five. The password is easier to read aloud and copy, with a small loss of strength that a little more length makes up for.

How do you avoid this problem next time?

• Read the rules before you type. Many forms show them only after an error.
• Let a password manager store the result. Then a compromise forced by one site's rules does not have to be remembered.
• Keep one password per account. A password a site accepted is still not safe to reuse elsewhere.

If this password is one you must remember and type yourself, see how to make a strong password you can remember.

Fast fixes

Which special characters are allowed in passwords?

It depends on the site. If the form lists them, use only those. If it does not, letters and numbers with a little extra length are the safest choice.

Why won't a website accept my password when it meets the rules?

Look for a hidden space, an auto-capitalised first letter, or a symbol the site blocks without saying so. Count the characters and generate a version without symbols.

Is a password without symbols weak?

Not if it is long enough. A longer password of letters and numbers can be stronger than a short one with symbols.

Why do websites limit password length?

Each site has its own reasons, often older software. Security guidance recommends that sites accept long passwords, but you still have to fit the limit a site sets.

Is it safe to use an online password generator?

Use one that creates the password in your browser and does not send it anywhere, as ours does. Then copy it straight into the site or your password manager.