Password Security: The Significance of Upper and Lower Case Characters
Mixing uppercase and lowercase doubles the number of possibilities per character, from 26 to 52. That is a real gain, but it is far smaller than the gain from adding characters. Four extra characters multiply the search space by roughly 450,000; switching on capitals multiplies it by 256 across an eight-character password.
This page shows the arithmetic, states the assumptions behind the crack-time figures rather than hiding them, and sets out what current guidance actually recommends — which is not what most password rules still enforce.
Note: never paste a real password into any online tool, including ours. The case converter is for ordinary text. Passwords belong in a password manager.
The arithmetic
The number of possible passwords is the size of the character set raised to the power of the length.
| Character set | Size | Example |
|---|---|---|
| Lowercase only | 26 | summer |
| Lower + upper | 52 | Summer |
| Lower + upper + digits | 62 | Summer26 |
| All printable ASCII | 95 | Summer26! |
Adding capitals takes the base from 26 to 52. Over eight positions that is 52^8 / 26^8 = 2^8 = 256 times more combinations. Useful, and free.
Combinations and time to crack
The assumption behind these numbers. They model an offline attack against a leaked database hashed with a fast algorithm, at 100 billion guesses per second. That is a deliberately pessimistic scenario. Against a live login form with rate limiting, or a database hashed with bcrypt or Argon2, the same passwords last vastly longer. The figures are for comparing options, not for predicting real outcomes.
| Password | Set | Combinations | Time at 10^11 guesses/s |
|---|---|---|---|
| 8 chars, lowercase | 26 | 2.1 × 10^11 | 2 seconds |
| 8 chars, mixed case | 52 | 5.3 × 10^13 | 9 minutes |
| 8 chars, mixed + digits | 62 | 2.2 × 10^14 | 36 minutes |
| 8 chars, everything | 95 | 6.6 × 10^15 | 18 hours |
| 12 chars, lowercase | 26 | 9.5 × 10^16 | 11 days |
| 12 chars, mixed case | 52 | 3.9 × 10^20 | 124 years |
| 12 chars, mixed + digits | 62 | 3.2 × 10^21 | 1,000 years |
| 12 chars, everything | 95 | 5.4 × 10^23 | 170,000 years |
Read the two lowercase rows against each other. Going from 8 to 12 lowercase characters moves 2 seconds to 11 days — a factor of about 450,000. Going from 8 lowercase to 8 mixed-case moves 2 seconds to 9 minutes — a factor of 256. Length is the dominant term. Use both, but if you can only do one, make it longer.
Why the arithmetic overstates real security
Those numbers assume every position is chosen at random. Human passwords are not random, and attackers know exactly how they are not:
- The capital is at the start. Summer2026 rather than suMmer2026. A cracking rule that capitalizes the first letter costs an attacker nothing.
- The digits are at the end. Usually a year, and usually a recent one.
- The symbol is a final exclamation mark. Present in a large share of passwords that satisfy a symbol requirement.
- Substitutions are predictable. P@ssw0rd is in every wordlist. Leetspeak was solved decades ago.
A password that satisfies a composition rule in the most obvious way has far less real entropy than its length and character set suggest. That is the reasoning behind the change in official guidance below.
What current guidance says
The United States National Institute of Standards and Technology publishes the digital identity guidelines that most organizations follow, in NIST Special Publication 800-63B. Its recommendations to system operators are:
| Recommendation | What it replaced |
|---|---|
| Do not impose composition rules | Requiring one uppercase, one digit and one symbol |
| Do not force periodic changes without cause | Expiring passwords every 90 days |
| Check new passwords against known breached lists | Relying on complexity alone |
| Allow at least 64 characters | Short maximum lengths |
| Accept all printable characters including spaces | Banning symbols for technical convenience |
| Allow paste, so managers work | Blocking paste in password fields |
The reasoning is that composition rules push people toward the predictable patterns listed above, while doing little to increase real randomness. Length and screening against breach lists do more.
Passwords are case-sensitive
This is worth stating plainly because it causes real lockouts. Summer2026 and summer2026 are two different passwords, and almost every system treats them as such. Three practical consequences:
- Caps Lock is the most common cause of a failed login. Check it before assuming the password is wrong.
- Mobile keyboards often auto-capitalize the first character of a field. If a password fails on a phone but works on a desktop, that is usually why.
- Some older systems, and a few mainframe environments, uppercase the whole input before hashing. Where that happens, mixed case adds nothing at all.
Compare this with email addresses, where the domain is case-insensitive, and with web addresses, where the domain is case-insensitive but the path usually is not. The general rules for where case carries meaning are in uppercase and lowercase letters explained.
The characters to avoid in a password you type
If a password will be read aloud, copied from paper or typed on an unfamiliar keyboard, some characters cause more trouble than they are worth:
| Confusable | Why |
|---|---|
| uppercase I, lowercase l, digit 1 | Nearly identical in many fonts |
| uppercase O, digit 0 | Same problem |
| uppercase B, digit 8 | Confusable in condensed faces |
| Symbols that move by keyboard layout | @ and " swap between US and UK layouts |
None of this applies to a password stored in a manager and never typed, which is the case that should be normal.
What to do instead
- Use a password manager and let it generate long random passwords. This removes the whole problem: you never type them and they are never reused.
- Where you must remember one, use a passphrase. Four or five unrelated words are long, memorable and easy to type. Length carries the strength.
- Never reuse a password across sites. Reuse is the single largest cause of account takeover, and no amount of complexity protects against it.
- Turn on two-factor authentication wherever it is offered. It defeats a stolen password outright.
- Mix cases anyway. It costs nothing and it does help — just do not treat it as the main defence.
A caution about tools. Do not paste a real password into an online strength checker, a case converter or any other web tool. Use the strength meter built into your password manager, which runs locally.
Frequently asked questions
Does using uppercase and lowercase make a password stronger?
Yes. It doubles the possibilities per character from 26 to 52, which across eight characters is 256 times more combinations. Adding length helps far more.
Is length or complexity more important?
Length. Adding four characters to a lowercase password multiplies the search space by about 450,000; adding capitals to an eight-character password multiplies it by 256.
Are passwords case-sensitive?
Almost always. Summer2026 and summer2026 are different passwords on virtually every modern system.
Why does NIST advise against requiring an uppercase letter?
Because composition rules push people toward predictable patterns — a capital at the start, a year at the end, an exclamation mark last — which attackers already model. Length and breach screening do more.
Is a passphrase better than a complex password?
For a password you have to remember, usually yes. Four or five unrelated words are long enough to be strong and easy to recall, and length is what carries the strength.
How long should a password be?
Guidance sets a minimum of eight characters, but for anything that matters use twelve or more, or a passphrase. With a password manager, use whatever maximum the site allows.
Does putting the capital at the start help?
Barely. It is the first pattern any cracking tool tries. A capital in an unpredictable position is worth more, though a longer password is worth more still.
Can I use a case converter on my password?
No. Never paste a real password into any web tool. Use the generator and strength meter in your password manager, which run on your own device.
The short version
Mixing uppercase and lowercase doubles the possibilities per character and costs nothing, so do it. But do not mistake it for the main defence: length beats complexity by orders of magnitude, predictable patterns undo most of the benefit, and reuse defeats everything. A password manager, long generated passwords and two-factor authentication matter more than where you put the capital letter.