Passphrase, But the Site Demands Special Characters: What Actually Works

You type in your five-word passphrase, hit enter, and the site rejects it. Must contain a special character. Must contain a number. Must be at most 16 characters. So here is how to use a passphrase on sites that require special characters, without turning the thing into soup you cannot remember.

That red error box is more common than it should be. NIST's own password guidance (SP 800-63B) has said for years that composition rules are a bad idea: length beats complexity, and forcing symbols mostly trains people to write down "Summer2026!" somewhere. But the sites did not get the memo, so you adapt the passphrase instead of fighting the form.

Option one: make the separator do the work

The simplest fix is to join your words with a symbol instead of spaces or hyphens. If your passphrase is tutor poncho audible maternal walk, write it as tutor!poncho!audible!maternal!walk. One validator sees five words and a pile of special characters; you see the same five words with punctuation.

This keeps the strength where it was. The security of a passphrase comes from the number of random words, not the decorations. A hyphen separator and an exclamation separator have the same word count underneath, and attackers guessing passphrases work at the word level. The symbol is camouflage for the site's rule, and camouflage that costs you nothing to remember is free.

Where this breaks: length caps. Some sites allow 16 or even 12 characters, and five words plus separators will not fit. If the limit is short, generate fewer words and accept the tradeoff, or treat that site as a random-password site and store it in a manager.

Option two: the salt trick

Security author Carey Parker (of Firewalls Don't Stop Dragons) describes a second method I like better for long passphrases: append a short memorized "salt" made of digits and symbols, something like 8$9#, to the end of the passphrase. tutor-poncho-audible-maternal-walk-8$9# passes any validator you will ever meet, and you only had to memorize four extra characters once.

Why this beats typing !1 at the end, which is what most people do: everyone types !1 at the end. Attackers know it, password lists are full of it, and it adds about one bit of real security. A salt you chose yourself and reuse across passphrases is not obviously stronger on paper, but it is not the thing everyone else appends, which counts for something when the attack is against a leaked hash.

How to use a passphrase on sites that require special characters

Decision rule, one line each. If the site has no length cap and no symbol rule, use plain words. If the site demands symbols but allows long passwords, use the separator trick, because the words stay readable. If the site has a strict length cap or four separate rules (upper, lower, digit, symbol), use the salt trick, because you will need the symbol set concentrated in a few characters.

And a line I should say out loud: if the site's rules are so restrictive that your passphrase degrades to something like Tut0r!Pon9, stop. That is a random password now, and random passwords belong in a password manager, not in your head. The whole point of a passphrase is memorability. Use the manager for that site and keep the passphrase for the handful of secrets you actually type: the manager's master password, disk encryption, Wi-Fi.

What does not help

Capitalizing the first letter of each word satisfies "must contain uppercase" and is what roughly everyone does, so assume attackers assume it too. Leetspeak substitutions (a to @, e to 3) are in every wordlist built after 2005. Birth years as the digits: memorable, and the first thing a targeted attacker tries. None of these are catastrophic if the word count is high, but none of them buy what people think they buy.

Frequently asked questions

Can I use a passphrase if a site requires special characters?

Yes. Generate a word-based passphrase and then adapt it: join the words with a symbol like a dash, or append a short string of digits and symbols. The word part carries the security; the symbols satisfy the site's validator.

Is adding !1 to the end of a passphrase enough?

It passes the site's check but adds almost no real security, because attackers already assume those endings. A longer passphrase or a memorized salt string mixed into the middle is stronger.

What does NIST say about password complexity rules?

NIST's SP 800-63B guidelines moved away from mandatory composition rules toward longer passwords, checking new credentials against lists of known-compromised passwords, and avoiding forced periodic changes. Complexity rules like required symbols are not recommended by current NIST guidance.

Should I just use a password manager instead?

For sites you visit with a manager open, a random password is easier than a passphrase. Passphrases are for the handful of secrets you must type from memory: your manager's master password, disk encryption, Wi-Fi.