Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What is the reason that most websites limit to 16 characters?

I would have thought the longer the password the more difficult it makes it for someone to crack it?

Is it something to do with hash collisions?

share|improve this question
Good question, wondered the same thing, I know hotmail does it as well. –  Lucas Kauffman Jul 31 '12 at 21:36
One email provider/ISP has a 10 characters limit for some passwords and 8 char for others. And they store many (not all) passwords in cleartext. –  curiousguy Jul 31 '12 at 21:54
To prevent buffer overflows naturally ;-) –  Andrew Smith Jul 31 '12 at 22:33
I know a site that restricts passwords to [a-zA-Z]{1,5} It is a billing portal and it scares me :( –  Kurt Aug 2 '12 at 1:13
@Prowla Sites with such limits on passwords scare me too! –  orange Aug 8 '12 at 15:28

3 Answers 3

up vote 17 down vote accepted

If you are to abide by CWE-521: Weak Password Requirements. Then all passwords must have a min and max password length.

There are two reasons for limiting the password size. For one, hashing a large amount of data can cause significant resource consumption on behalf of the server and would be an easy target for Denial of Service. Especially if the server is using key stretching such as PBKDF2.

The other concerns is hash length-extension attacks or the prefixing attack against MD5. However If you are using a hash function that isn't broken, such as bcrypt or sha-256 , then this shouldn't be a concern for passwords.

IMHO 16 bytes is far too small. bcrypt has a built-in cap of 72 characters, which is probably a reasonable size for a heavy hash function. Key Stretching used by these functions creates the possibility of an Algorithmic Complexity Attack or ACA.

share|improve this answer
What is a "broken hash function" in this context? –  curiousguy Jul 31 '12 at 22:03
@curiousguy MD4, MD5 SHA0, SHA1 would be broken hash functions. –  Rook Jul 31 '12 at 22:04
Thank you! This makes sense now. –  orange Aug 8 '12 at 15:28
"hashing a large amount of data can cause significant resource consumption" Calculating a (any) hash hardly takes CPUs. Hashes were designed for that. –  Jan Doggen Feb 15 '13 at 8:19
@Jan Doggen A good password hash function, like bcrypt and PBKDF2 is most likely the heaviest calculation an application is exposing to an attacker. Key stretching by definition is an "Algorithmic Complexity Attack" or ACA. –  Rook Feb 15 '13 at 17:41

What is the reason that most websites limit to 16 characters?

Arbitrary implementation limit.

Maybe they only want to allocate a 17 octets buffer (16 ASCII/1-octet characters + terminating NUL).

Maybe they believe that more than having a password with 16 characters is useless or silly, because they have no understanding of passwords.

I would have thought the longer the password the more difficult it makes it for someone to crack it?

Indeed. A password with 16 random independent alphabetic characters with a uniform distribution has enough entropy. But human being are bad at randomly choosing 16 random independent alphabetic characters with a uniform distribution, and terribly bad at remembering such meaningless characters sequences, so they choose passwords that they can remember, but with less entropy per character.

What matters is only the total entropy, not the entropy per character. For example a sequence of random dictionary words, generated with a word-dice (word-dice: open a random page in a dictionary, etc.) is easier to remember than a sequence of letters obtained with a letter-dice.

Such passwords will be longer than purely random letter sequences, but they will be a lot easier to remember for equal entropy, or if you prefer they will have a lot more entropy for equal mental memory effort.

For adequate strength, these passwords made of dictionary words will probably have more than 16 characters.

IOW, this limit is stupid.

Is it something to do with hash collisions?


There is no formal guaranty WRT to collisions with short passwords. But the practical impact of hash collisions is non existent.

share|improve this answer
If the max is 16 chars, there's no need for a 17th octet to hold the terminating NULL - you just read until you have either a NULL or all 16 chars. –  Moshe Katz Jan 7 at 2:06

I think its just a standard thing. MOST individuals don't have passwords over 16 characters long and even that is quite a long password even for those with security in mind... especially on forums or websites that don't require ULTRA security.

Another important point to note is that various encryption schemes have variable length requirements. For instance, DES passwords are limited to 8 characters, MD5 passwords are limited to 16 characters, Blowfish passwords are limited to 32 characters. Since (I'd say) 95% of all sites use some form of a MD5 (sometimes salted sometimes not), the length required is 16 characters.

There are other reasons bot off the top of meh ol noggin, id say this should satisfy your thirst of knowledge!

share|improve this answer
Hash functions can take an unlimited size input and will always the same output. –  Rook Jul 31 '12 at 21:53
There is no such thing as a "DES password", or "MD5 password", or "Blowfish password". DES and Blowfish are encryption functions and deal with 2 inputs: cleartext and key. MD5 is a hash function so only has one input. To be honest, you do not seem to have any idea how any of those functions (MD5, DES...) are used. –  curiousguy Jul 31 '12 at 21:53
You are thinking of bcrypt (which is a hash function, not an encryption algorithm like blowfish) and 3-des using a feedback to create a hash function (which should never be used by anyone, ever). –  Rook Jul 31 '12 at 22:03
What do you call a "DES password"? Is it a DES key? Why would anyone use DES for anything (instead of 3DES)? Why would you limit the input of MD5 to 16 characters? What you say makes strictly no sense. –  curiousguy Aug 1 '12 at 0:13
@Anonymous: I'm pretty sure md5 can be used to hash entire files (ie: much larger than 16 characters). –  rox0r Aug 3 '12 at 20:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.