The ideal password selection method is to generate a random string that is so long an attacker would find it practically impossible to iterate through all random strings of the specified length, and for the user of the password to then perfectly recall the password. Two practical impediments immediately apply: the inability of users to remember random strings and the impracticality of deducing from a specific single string that a random selection produced it and from what space it might have been selected. Commonly, this difficulty is addressed by a password policy, such as that published by the US National Institute of Standards and Technology (NIST). We discuss the weaknesses of rules-based policies and the inevitable trade-off between rules that delimit “bad” passwords and allowing the space from which passwords are chosen to expand. This presentation will give you a better understanding of principles in password policies and insights into how “good” password policies can be circumvented and can sometimes be counter-productive.