What are characters in a password?
Definition
Characters in a password are the individual symbols you type to make it up: letters, numbers, spaces and symbols such as ! or #. Password length is the number of characters.
- Category
- Security
- Also called
- password character, characters in a password, special characters in a password, Character (in a password)
- Last updated
A character is a single symbol in a password. NIST's glossary describes a password as a string of characters, such as letters, numbers and symbols, used to verify who you are. "Summer2025!" has 11 characters: one capital letter, five lowercase letters, four digits and one symbol.
Types of characters
- Letters: uppercase (A to Z) and lowercase (a to z)
- Numbers: 0 to 9
- Special characters or symbols: punctuation and signs such as ! @ # $ % & *
- Spaces: allowed by many sites, and useful in passphrases
Which ones a site accepts is up to the site. Some reject certain symbols or cap the length, which is a sign of poor design but still something you'll run into.
Length beats variety
Sites often demand "one capital, one number and one symbol". NIST's digital identity guidelines advise against forcing those rules. Its FAQ says composition rules tend to backfire, because people dodge them with predictable changes such as swapping an "a" for "@" or adding "1" at the end. Attackers know those habits.
Current advice leans on length and uniqueness instead. CISA recommends at least 16 characters, and the FTC suggests at least 12. CISA also suggests a passphrase of four to seven unrelated words, which is long and easier to remember than a random string.
What a password manager does
A password manager generates a long random string with every character type and stores it, so you don't have to remember it. You then only need to memorise one strong password for the manager itself.
How to protect yourself
- 1
Make it long
Aim for at least 16 characters where the site allows it. A passphrase of several unrelated words works well.
- 2
Use a different password for every account
If one site is breached, a reused password lets attackers try it everywhere else.
- 3
Let a password manager do the typing
It creates long random passwords, fills them in and keeps them out of your head and your notes app. Pick one that lets you protect access with multi-factor authentication.
- 4
Turn on two-factor authentication
A second step stops most account takeovers even when a password leaks. See two-factor authentication.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What counts as a special character in a password?
Usually any symbol that isn't a letter or number, such as ! @ # $ % ^ & *. The exact list differs from site to site.
Do I need special characters if my password is long?
NIST advises sites not to force them. A long, unique password or passphrase is stronger than a short one with a symbol added at the end.
How many characters should a password have?
CISA recommends at least 16 and the FTC suggests at least 12. Longer is better, as long as it's unique to that account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.