| Requirement | Detail | |-------------|--------| | Minimum Length | 36 characters for any credential that accesses:
• SCADA/Signalling control panels
• Train‑control software
• Passenger‑information portals
• HR/Finance ERP systems | | Allowed Character Set | Upper‑case (A‑Z), lower‑case (a‑z), digits (0‑9), and at least four of the following special symbols: ! @ # $ % ^ & * ( ) - _ + = [ ] : ; " ' < > , . ? / \ | ~. | | Passphrase Flexibility | Users may create a passphrase (a series of unrelated words) that meets the 36‑character minimum, encouraging memorability while preserving entropy. Example: Blue!5Mango&13River$Sunset@Orbit# (44 characters). | | Prohibited Patterns | No dictionary words longer than three consecutive characters, no repeated sequences (e.g., abcabcabc), and no personal identifiers (employee IDs, birthdates, vehicle numbers). | | Rotation & Reuse | Passwords must be changed every 180 days. Reuse of any of the last 12 passwords is disallowed. | | Multi‑Factor Authentication (MFA) | R‑R15 requires MFA for every privileged login, regardless of password strength. MFA methods may include hardware tokens, push‑notification apps, or FIDO2/WebAuthn keys. | | Secure Storage | All passwords must be hashed with Argon2id (or an equivalent memory‑hard algorithm) and salted per‑account. | | Audit & Reporting | Continuous logging of password‑change events, MFA challenges, and failed login attempts. Quarterly compliance reports must be submitted to the national rail cyber‑security authority. |

| Do | Don’t | |----|-------| | Use four unrelated words + two symbols + two numbers (e.g., Solar!28Falcon*River#85 → 36 chars) | Use a single dictionary phrase or a simple pattern like Rail2022!Rail2022!Rail2022! | | Insert capitalisation randomly (e.g., bLuE!5mAnGo&13rIvEr$SuNsEt@OrBiT#) | Use all‑lowercase or all‑uppercase only. | | Leverage a password manager to store the full string, but remember the first 8‑12 characters as a mental cue. | Write the password on sticky notes or share it via email. |

Let’s parse the keyword phrase piece by piece:

Across multiple gaming communities (Reddit’s r/puzzlegames, TouchArcade forums, and GameFAQs), users have reported that entering 36 (or PASS36, RT36, or 36NEW) at the password screen instantly jumps you to Level 15, bypassing the first 14 levels.

But is this true? We tested it.

Level 15 in Rule the Rail is notorious. It is not a tutorial level, nor is it an endless runner. It is the first true "boss puzzle" of the game. Here is what makes it so brutal:

Most casual players spend 20–45 minutes on this single level. Many quit entirely. That is why the promise of a "new" password for level 15 is so alluring.

Product: Rule the Rail! Version: 1.5 (often referenced as "15" in search queries) Context: Password/Credential Inquiry ("password 36 new")