All 30 Password Games Directives, Ranked by Pain

18 August 2026

Every run of The Password Games ends the same way: you, staring at a text field, negotiating with a plant. The Vault Security Committee issues 30 directives and every one of them stays active until the end. Some are speed bumps. Some are war crimes. Here is the full ranking, gentlest first, based on where players actually fail. Spoilers for all 30 rules, obviously.

The warm-up (barely rules)

30. Directive 1: minimum length. Type some characters. If this one stops you, close the tab and reflect.

29. Directive 3: uppercase letter. Hold Shift. Done.

28. Directive 2: include a number. Free now, but every digit you add is a debt Directive 8 will collect later.

27. Directive 4: special character. Specials are the safest characters in the game. Almost nothing later restricts them.

26. Directive 5: day of the week. Type a weekday. Just know that “Wednesday” is the longest option at nine letters, and two of them are E’s you will be counting in Directive 23.

The thinking begins

25. Directive 7: planet. Eight options. Mars is short and vowel-cheap. Most players learn this the second run.

24. Directive 14: rhymes with key. A small word puzzle. “Tea” or “bee” and you move on.

23. Directive 22: first character uppercase vowel. Trivial to satisfy, annoying to maintain, because everything you add later must go behind it.

22. Directive 15: rock-paper-scissors emoji. Beat the Committee’s throw with the right emoji. A coin flip’s worth of thought.

21. Directive 16: month backwards. “yam” is three characters. In September you will be spelling “rebmetpes” whether you like it or not, because the calendar picks the month, not you.

20. Directive 6: prime length. Pad to 23 or 29 characters. Easy now, but it fights the length cap and the seal later.

19. Directive 9: arithmetic answer. Do the math, type the result. The pain is that it adds digits, and digits feed Directive 8.

18. Directive 10: binary hour. Convert the current hour to binary. Fine, unless the hour rolls over mid-run and your password silently breaks.

The squeeze

17. Directive 11: palindrome. Embed a palindrome of at least four characters. “otto” works, and “1221” works without spending a letter. Cheap, but one more region of your password you cannot casually edit.

16. Directive 12: landlocked country. Chad. Four letters, one vowel, no E. Players who type Liechtenstein here deserve what happens to them in Directive 27.

15. Directive 19: exile a digit. Ban one digit forever. Feels easy, but exile the wrong one and Directive 8’s perfect-square math gets ugly.

14. Directive 24: flower beside Fern. Place a flower emoji next to Fern. Simple, except Fern’s neighborhood is now two protected characters wide and you edit near her at your own risk.

13. Directive 23: state your E count. Declare how many E’s your password contains. The declaration can change the count. Solving that little feedback loop is a rite of passage.

12. Directive 8: digit-sum perfect square. All your digits must sum to a perfect square. Every numeric rule before and after has to route through this. The silent killer of the mid-game.

11. Directive 25: exile a letter. Ban a letter forever, while your password is full of words you need. Exiling anything common costs you. This is why you budgeted rare letters, right?

The endgame

10. Directive 13: magic square. Complete a 3x3 magic square and get those digits in. Heavy digit load, and yes, Directive 8 is still watching.

9. Directive 21: exact Scrabble score. Hit an exact letter-value total. One character added or removed anywhere reshuffles it. Pure bookkeeping under pressure.

8. Directive 17: Fern joins. A plant now lives in your password. She is a character you cannot delete. Welcome to responsibility.

7. Directive 26: vowels upper, consonants lower. Recase your entire password. This retroactively breaks your weekday, your country, everything with mixed case. Budget a full minute.

6. Directive 18: water Fern. Fern drinks a droplet every 40 seconds and holds a maximum of three. From here on, every puzzle is on a timer you cannot pause. Top her up before thinking hard.

5. Directive 27: no letter more than 4 times. The bill for every wordy choice you made arrives at once. Five A’s? Rewrite. This rule fails more veteran runs than any other mid-game directive.

4. Directive 20: virus outbreak. Viruses infect your password and each one needs soap, three cleanses to clear an infection, while Fern still needs water and every rule still applies. The first true panic moment.

3. Directive 28: length cap. After 27 rules of adding, you must now cut, without breaking the palindrome, the country, the Scrabble score, or Fern. Compression is harder than construction.

2. Directive 29: the vault seal. Keep your password fully valid and untouched for 30 continuous seconds. Water Fern to three droplets, then take your hands off the keyboard and pray nothing time-based rolls over.

1. Directive 30: the vault code. Decode an emoji cipher and type the code into the vault terminal, not your password, within 60 seconds, with every other directive still live. It is a timed exam at the end of a marathon. Beat it and the vault opens.

Want the strategy instead of the autopsy? Read how to beat The Password Games, or open the full guide index and study before the Committee convenes.