Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 0 down vote favorite
1

Please See Why Not Allow Special Characters In a Password on Security.

Several websites I've come across limit the allowed special characters for a password. My thought was, it should all be hashed anyway so why does it matter?

Is there an actual security reason to restrict this?

Example error: The password needs to be at least 4 characters. Valid characters are: letters, numbers and the following symbols: #$%&!?@.

share|improve this question
2  
I'd say ease of use. A password with a newline or control character in it would be somewhat awkward to type in. Since nobody will ever use those, why not disable them and spare an unlucky user the pain of figuring out why his password is not being accepted the next time he types it in? – Thomas Mar 20 at 12:03
@Thomas I can see your point for control characters. But the filters are often very restrictive. Like the given example. -_^[]{}'"~;:<>/\* are all not allowed, yet very sane options even in the ASCII range. I mean, if you're worried about character encoding I can see you'd restrict €©‘«»Ñé何 and things like that. – Beanow Mar 20 at 12:10
I think the programmer is usually to blame when the filters are too arbitrary and restricted. There are usually no cryptographic reasons for such restrictions, except possibly if the code has an algorithm for estimating the password strength that for some reason only works with a limited character set. – Henrick Hellström Mar 20 at 12:15
2  
The traditional reason to prevent special characters in passwords is that sometime the password might need to be entered on a device/context (e.g. physical terminal, bootloader) different from the one where the password is defined on (e.g. some full-blown GUI), and special characters might be difficult or impossible to key in the former environment. Users of AZERTY keyboards often learn the hard way it is safer to choose passwords that key-in identically on a QWERTY keyboard. ^ is especially problematic, for it is a dead key on only some keyboards. This really belongs to security.se – fgrieu Mar 20 at 13:43
Some keyboards lack some characters, and outside ASCII you'll need to be careful about encoding. – CodesInChaos Mar 20 at 18:04
show 1 more comment

closed as off topic by fgrieu, Hendrik Brummermann♦ Mar 23 at 19:34

Questions on Cryptography Stack Exchange are expected to relate to cryptography within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

1 Answer

up vote 2 down vote

Summary of comments, not to take credit.

Answer so far is: cryptographically no. But it's practical for usability.

  1. Restricting control characters is useful for different interfaces/input methods.
  2. Restricting non-ASCII characters is useful for avoiding bugs with different encodings.
  3. Restricting characters that are not on every keyboard adds to the user-friendly experience (preventing the user from locking themselves out on a different device).
  4. Restricting characters that are in different locations on different keyboards prevents 'habit-mistakes' on different keyboards.
  5. When a password is easier to remember it's less likely to be written down (in theory) see: XKCD #936: Short complex password, or long dictionary passphrase?
share|improve this answer
For #5, that should be left to the user. The user might remember a password with some special characters better than one without. – Paŭlo Ebermann♦ Mar 21 at 21:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.