Requiring a symbol in every password sounds like it should improve security, and in theory it does add possibilities to the character pool. In practice, it often has an unintended side effect.

The predictability problem

When people are forced to include a symbol, most default to the same handful of choices — an exclamation point at the end, an "@" replacing an "a." Attackers know these patterns well, which means mandatory symbol rules often don't add as much real security as the raw math would suggest.

What actually helps more

• Length, which has a much larger mathematical impact than character variety
• True randomness, rather than predictable substitutions in an otherwise normal word
• Uniqueness across accounts, which protects you even if one password does leak

The best of both worlds

A password generator that includes symbols as one of several randomized character sets — rather than a single predictable symbol tacked onto a word — gets you both length and true randomness without the predictable patterns humans fall into.