# Sensible usecase for restricting special characters in passwords? [closed]

Please See Why Not Allow Special Characters In a Password on Security.

Several websites I've come across limit the allowed special characters for a password. My thought was, it should all be hashed anyway so why does it matter?

Is there an actual security reason to restrict this?

Example error:  The password needs to be at least 4 characters. Valid characters are: letters, numbers and the following symbols: #\$%&!?@. 

-

## closed as off topic by fgrieu, Hendrik Brummermann♦Mar 23 '13 at 19:34

Questions on Cryptography Stack Exchange are expected to relate to cryptography within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

I'd say ease of use. A password with a newline or control character in it would be somewhat awkward to type in. Since nobody will ever use those, why not disable them and spare an unlucky user the pain of figuring out why his password is not being accepted the next time he types it in? –  Thomas Mar 20 '13 at 12:03
@Thomas I can see your point for control characters. But the filters are often very restrictive. Like the given example. -_^[]{}'"~;:<>/\* are all not allowed, yet very sane options even in the ASCII range. I mean, if you're worried about character encoding I can see you'd restrict €©‘«»Ñé何 and things like that. –  Beanow Mar 20 '13 at 12:10
I think the programmer is usually to blame when the filters are too arbitrary and restricted. There are usually no cryptographic reasons for such restrictions, except possibly if the code has an algorithm for estimating the password strength that for some reason only works with a limited character set. –  Henrick Hellström Mar 20 '13 at 12:15
The traditional reason to prevent special characters in passwords is that sometime the password might need to be entered on a device/context (e.g. physical terminal, bootloader) different from the one where the password is defined on (e.g. some full-blown GUI), and special characters might be difficult or impossible to key in the former environment. Users of AZERTY keyboards often learn the hard way it is safer to choose passwords that key-in identically on a QWERTY keyboard. ^ is especially problematic, for it is a dead key on only some keyboards. This really belongs to security.se –  fgrieu Mar 20 '13 at 13:43
Some keyboards lack some characters, and outside ASCII you'll need to be careful about encoding. –  CodesInChaos Mar 20 '13 at 18:04