Password requirements

What this covers

Exactly what is checked when you set a password, why those things and not others, and what to do about each rejection. Applies to everyone — your own password, a password a Manager sets for you, and a password reset.

The rules

At least 12 characters.
Not one of your last four passwords.
Not a password known from a public data breach.
Not built from your own details — your name, your email, your restaurant's name or your property code.

That is the whole list. Note what is not on it.

What is deliberately not required

No capitals, numbers or symbols

There is no rule demanding a mix of character types, and that is a considered decision rather than something missing.

Those rules do not produce strong passwords — they produce Password1!, which satisfies every composition rule ever written and is one of the first things any attacker tries. What they reliably produce is passwords people cannot remember, so they write them on a sticky note by the till.

Length is what actually matters. Four ordinary words are far harder to guess than eight characters of punctuation soup, and you can remember them. Instead of pretending a symbol makes a password safe, Tabledoo does the real check: it looks up whether your password has actually appeared in a breach.

No expiry

Your password never expires and you are never forced to change it. Forced rotation makes passwords worse, not better — people faced with a quarterly change pick Summer2026 and then Autumn2026.

Change your password when there is a reason: you shared it, you suspect it is known, or it was set for you by somebody else. Not because a calendar said so.

The four rejections, and what to do

"The password must be at least 12 characters"

Use a passphrase: three or four unrelated words run together, with or without spaces. copper-lantern-thursday is 23 characters, trivial to remember and enormously harder to guess than anything you would invent to satisfy a symbol rule.

"Your password must not contain your name, email, or the restaurant's details"

Something in your password matches information about you or your restaurant. What is checked:

Your restaurant's name, whole or in parts
Your property code
The first part of your email address
Your name, whole or in parts
Obvious generic words — tabledoo, restaurant, booking

This catches the genuinely common pattern: someone at The Old Bell choosing oldbell2026. Anyone targeting your restaurant starts with your restaurant's name — it is on your website, your door and your booking page.

To get past it: pick words with nothing to do with your restaurant or yourself.

"You have used this password recently. Please choose a different one"

It matches one of your last four passwords. Reusing a password defeats the point of having changed it — particularly if you changed it because it may have been exposed.

To get past it: choose a genuinely new one. Adding a digit to your old one is a different password to the checker but the same password to anybody who knew the old one.

"This password has appeared in a public data breach"

Your password has been found in a published list of leaked passwords. It does not mean your account was breached — it means this exact password is in a collection attackers already have, so it would be among the first tried.

This is the most useful check of the four and the one people find most surprising, because it catches passwords that look strong. Tr0ub4dor&3 is in those lists.

To get past it: choose something else, ideally a passphrase. And if you were using that password anywhere else, change it there too — that is genuinely worth doing today.

Your password is never sent anywhere to perform this check; it is done in a way that does not reveal it.

Choosing a password you will actually use

Best: a password manager

Let it generate and remember a long random password. You need to remember one strong passphrase for the manager itself, and nothing else. Most phones and browsers now include one at no cost.

Very good: a passphrase

Three or four unrelated words. Not a quotation, not a song lyric, not your restaurant's tagline — those are in wordlists. anchor-velvet-harbour, not thebestpizzaintown.

Fine: a long sentence

A memorable sentence with the spaces left in. Length does the work.

Two things worth doing beyond a good password

Turn on two-factor authentication, which makes a stolen password insufficient by itself (link Two-factor authentication).
Never share a login. Each person should have their own, so a password change affects one person (link Adding staff accounts).

Good to know

These rules apply everywhere a password is set — your own change, a Manager setting one for you, a reset link, and a brand-new account. There is no weaker path in.

The rules are the same for every restaurant. They are not configurable, deliberately — one clear policy rather than a setting somebody would eventually weaken.

Changing your password clears any lockout on your account (link Unlocking a locked-out account).

The checks run in order and stop at the first failure, so fix the one you are shown and try again — there may be another behind it.