TL;DR: Most “the generator is broken” stories are a copied fragment, a trailing space, a site that silently shortens the password, or a second device still offering the old secret. Compare length, retype the confirmation field from the manager, and only then generate a replacement. Draw a new password after you know the previous one was saved wrong, not as a first reflex while the real one is sitting in a manager you forgot to check.
The capital letter that never left the laptop
A volunteer treasurer changed the password on a youth-club banking site during a committee meeting. She generated it on a laptop, saved the manager entry, and thought the group was done. The next morning her phone, which had an old autofill copy, failed three times and the bank locked the profile. She was convinced the generator had produced characters the bank “did not really accept.” The lockout email showed the username she expected. When we looked at the manager, the stored password was twenty characters. The phone’s saved copy was the previous one, twelve characters, ending in the year. Nothing was wrong with the new string. Two memories of the password existed, and the phone had the retired one.
Failures that happen before the site even judges you
Partial copy is the classic. A double-click selects a word-like chunk of a random string and leaves the rest behind. The confirmation field then matches the fragment, so the site happily stores a shorter password than the one in your manager. Next login, you paste the long version and get rejected. Prevention is to select from the start of the field to the end, then glance at the character count if the manager shows one.
- Trailing space from a phone keyboard makes two strings that look identical and are not.
- Leading character dropped when a form’s placeholder text eats the first paste.
- Old manager entry on another device fills yesterday’s password without a warning banner.
- Caps lock matters only if you are typing by hand. Pasting is immune, which is a reason to paste.
- Wrong username paired with the right password looks exactly like a bad password.
Sites that punish good passwords
Some forms reject specific symbols and say so. Others reject them with a generic “try again.” A few accept the password, store only the first twelve characters, and never tell you. If a long password fails immediately with a clear rule, adjust and generate again. If it seemed to save and then fails on the next login, try the first block of characters only as a diagnostic, then change the password to a length under the suspected cap and update the manager to match what you now believe the server kept. Do not leave a note that says “maybe truncated” and hope.
Banned characters are not a reason to switch to a pet name. Turn the symbol class off, keep letters and digits, and add length if the form allows. The policy is annoying. It is still compatible with randomness.
Account lockouts
Three fast failures can freeze a profile even when the fourth attempt would have been right. Stop guessing from memory. Wait out the lock, open the manager, and paste once. If you have been pasting the manager value and it still fails, use the site’s reset flow and retire the stored secret afterward. Hammering the form with small edits of a memorable password is how lockouts become support tickets.
The edit that felt harmless
People generate a solid password and then change one character so it “includes something I will recognize if the manager fails.” The site stored the edited version. The manager has the original, or the reverse. Both feel correct because they look alike in a quick glance. If you edit, edit the manager and the form in the same minute and then stop. Better: do not edit. Draw a new string that already satisfies the rule you were trying to meet by hand.
Sync delay is the cousin of this bug. You update a manager on the laptop and the phone is offline. You try the phone, get the old password, and blame the bank. Confirm the phone vault has synced before you count the attempt as a true rejection.
Two browsers, one of them stale
People keep Chrome for work and Firefox for everything else, or Edge because a bank once demanded it. A password change saved in one browser’s vault does not automatically repair the other. The next failure then happens in the browser you use less often, which makes it feel random. Pick the browser that holds the manager extension and use it for the test login. If the second browser still has the old password, delete that saved login so it cannot autopilot you into a lockout while you are half awake.
A short diagnostic before you reset
Check the username, paste the full manager value, and compare lengths. Try one private window so an extension is not rewriting the field. If that fails, look for a published maximum length and for a second saved password hiding in the browser. Only then reset. When you reset, generate again, store the new value, and delete the old one so tomorrow’s phone cannot offer it with confidence.