Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password policy:

  • the use of both upper- and lower-case letters (case sensitivity)
  • inclusion of one or more numerical digits
  • inclusion of special characters, e.g. @, #, $ etc.
  • prohibition of words found in a dictionary or the user's personal information
  • prohibition of passwords that match the format of calendar dates, license plate numbers, telephone numbers, or other common numbers
  • prohibition of use of company name or an abbreviation

If I am a non Latin based language speaker, how do rules about upper and lower case work? It's not as simple as a-z and A-Z. What about dictionary lookups and prohibiting certain formats? This problem seems well know for English, but what about other languages and cultures?

share|improve this question
Excellent question. I'd never considered this before, beyond just mentally assuming that "nobody cracks cyrillic / arabic characters". –  Polynomial Jul 16 '12 at 19:38
I live in an arabic country and a majority of the times the passwords are in english, while all the reset of the software or system is in arabic. –  george_h Jul 17 '12 at 11:55
@george_h The passwords are really in English, and not just latinized Arabic words? –  msanford Jul 25 '12 at 17:40

4 Answers 4

Most drive-by password cracking attempts are going to assume that the password is a subset of ASCII characters. However, targeted attacks (under the Advanced Persistent Threat model) are likely to discover that your users aren't using ASCII passwords and change tact.

As such, I suggest the following rules:

  • Identify which languages are likely to be in use, based on your user base.
  • Perform dictionary lookups for those languages, and deny passwords based on them.
  • Ask native speakers to suggest common non-dictionary words and phrases that might be used as passwords.

If you can identify character subsets for each alphabet, you can apply individual entropy scores to them. This allows you to require a minimum security for such a password.

Probably the most important part is user feedback. Ask your users to report problems they find with the password system on your site, and suggest ways to improve the system. Only a native speaker can really identify weak passwords ahead of time.

share|improve this answer

I did find a Microsoft TechNet article, Passwords must meet complexity requirements, that seems to apply to their Windows Server based products. That adds another character group for "letters" that are neither upper nor lower case.

Passwords must contain characters from three of the following five categories:

  • Uppercase characters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters)
  • Lowercase characters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters)
  • Base 10 digits (0 through 9)
  • Nonalphanumeric characters: ~!@#$%^&*_-+=`|(){}[]:;"'<>,.?/
  • Any Unicode character that is categorized as an alphabetic character but is not uppercase or lowercase. This includes Unicode characters from Asian languages.
share|improve this answer
"Passwords must contain characters from three of the following five categories" how is that useful? –  curiousguy Jul 25 '12 at 17:49
@curiousguy uhh.. because it tells you what it has to have to be a password? If you don't meet the requirements, you can't set it. –  ekaj Jul 26 '12 at 14:31
Yes, of course. But what is the point of the rule? Why was the result invented? What makes the rule useful? –  curiousguy Jul 26 '12 at 14:40
I wonder what C# test is used for the last category? I'm implementing password rules, as per a clients request, but they deal with several languages include Arabic, Korean, Chinese, Japanese and Cyrillic, for which some of these rules are difficult to apply (or I need to get samples of passwords in those languages, and run tests against them to make sure they pass and fail appropriately). –  Reuben Aug 12 '14 at 4:20

All joking aside, xkcd's Password Strength comic may have particular relevance here since it's language-independent: верный лошадь батарейка штапель (example below in Russian) is full of entropy.

xkcd comic 936

share|improve this answer

Entropy analysis assumes that the password is contained of a patterned set of words or phrases derived from a known language. What if passwords are not composed of phrases found in any language? In other words the frequency of certain letters occurring in a typed page of text can be calculated and in latin and english based systems, this would correspond to ETAOINSHRDLU being the most frequent (thanks Carl, from his book Contact). So passwords made up of non-language based strings would be the hardest to crack (and consequently the hardest to remember). There are many ways formulate people friendly passwords without dipping into language as a source for your password strings. Some letters and numbers rhyme phonetically and entropy analysis does not take that into consideration (unless I missed something on the section on soundex libraries). Ironic that the very means we need to protect passwords from entropy and statistical analysis are also the ones that make passwords the least easy to remember. Password policies are designed to ensure a minimum level of protection despite what language the password is created in.

The question of policies and what sorts of characters from other non-latin languages is a great question for those of us who work primarily in latin based character sets. For instance, are there characters similar to the latin languages for other languages such as Thai or Arabic? What about symbol and object based languages like Chinese as inflections which are a common factor in english language in delineating the difference between a statement and a question. In Chinese, inflection is called pinyins, and pinyins actually change the definition of a word rather than delineating the difference between a statement or a question. So are there special characters in those languages that can be used like the special characters in latin based languages? Thats what it sounds like the question was getting at.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.