Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password policy:

  • the use of both upper- and lower-case letters (case sensitivity)
  • inclusion of one or more numerical digits
  • inclusion of special characters, e.g. @, #, $ etc.
  • prohibition of words found in a dictionary or the user's personal information
  • prohibition of passwords that match the format of calendar dates, license plate numbers, telephone numbers, or other common numbers
  • prohibition of use of company name or an abbreviation

If I am a non Latin based language speaker, how do rules about upper and lower case work? It's not as simple as a-z and A-Z. What about dictionary lookups and prohibiting certain formats? This problem seems well know for English, but what about other languages and cultures?

share|improve this question
Excellent question. I'd never considered this before, beyond just mentally assuming that "nobody cracks cyrillic / arabic characters". –  Polynomial Jul 16 '12 at 19:38
I live in an arabic country and a majority of the times the passwords are in english, while all the reset of the software or system is in arabic. –  george_h Jul 17 '12 at 11:55
@george_h The passwords are really in English, and not just latinized Arabic words? –  msanford Jul 25 '12 at 17:40

3 Answers 3

All joking aside, xkcd's Password Strength comic may have particular relevance here since it's language-independent: верный лошадь батарейка штапель (example below in Russian) is full of entropy.

xkcd comic 936

share|improve this answer

I did find a Microsoft TechNet article, Passwords must meet complexity requirements, that seems to apply to their Windows Server based products. That adds another character group for "letters" that are neither upper nor lower case.

Passwords must contain characters from three of the following five categories:

  • Uppercase characters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters)
  • Lowercase characters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters)
  • Base 10 digits (0 through 9)
  • Nonalphanumeric characters: ~!@#$%^&*_-+=`|(){}[]:;"'<>,.?/
  • Any Unicode character that is categorized as an alphabetic character but is not uppercase or lowercase. This includes Unicode characters from Asian languages.
share|improve this answer
"Passwords must contain characters from three of the following five categories" how is that useful? –  curiousguy Jul 25 '12 at 17:49
@curiousguy uhh.. because it tells you what it has to have to be a password? If you don't meet the requirements, you can't set it. –  ekaj Jul 26 '12 at 14:31
Yes, of course. But what is the point of the rule? Why was the result invented? What makes the rule useful? –  curiousguy Jul 26 '12 at 14:40
I wonder what C# test is used for the last category? I'm implementing password rules, as per a clients request, but they deal with several languages include Arabic, Korean, Chinese, Japanese and Cyrillic, for which some of these rules are difficult to apply (or I need to get samples of passwords in those languages, and run tests against them to make sure they pass and fail appropriately). –  Reuben Aug 12 at 4:20

Most drive-by password cracking attempts are going to assume that the password is a subset of ASCII characters. However, targeted attacks (under the Advanced Persistent Threat model) are likely to discover that your users aren't using ASCII passwords and change tact.

As such, I suggest the following rules:

  • Identify which languages are likely to be in use, based on your user base.
  • Perform dictionary lookups for those languages, and deny passwords based on them.
  • Ask native speakers to suggest common non-dictionary words and phrases that might be used as passwords.

If you can identify character subsets for each alphabet, you can apply individual entropy scores to them. This allows you to require a minimum security for such a password.

Probably the most important part is user feedback. Ask your users to report problems they find with the password system on your site, and suggest ways to improve the system. Only a native speaker can really identify weak passwords ahead of time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.