"Your password can't contain spaces." is a message I see from some websites, including 1 .
Why? (This question is very similar to Why Disallow Special Characters In a Password? , but the answers there don't seem to apply to the space character).
Some systems apparently strip out all spaces before hashing the password. ( How does Google not care about "spaces" in Application-specific passwords? )
Why not simply hash whatever the user typed in, spaces and all?
I can't explain it as anything beyond legacy madness, or lazily copying username restrictions to password restrictions without forethought.
Any block of data, printable or otherwise, should be acceptable if you're hashing your passwords. The only restrictions should be a minimum complexity and a "sanity" maximum length so somebody doesn't soak up 1MB of bandwidth (and the corresponding CPU time to hash the input because you use a slow algorithm, right?) every time they login.
\r\n vs \n).
Commented
Mar 15, 2013 at 21:52
Leading and trailing spaces could be trouble for people who are loose with copy and paste. Otherwise, agreed with the other posts, no good reason.
Although, what other characters are we blocking? tab, cr, lf, backspace, beep ☻☺♪▬♣. ?
The simple answer is that it is a bad password policy.
I can think of no particularly good reason for forbidding the space character. This is probably just some arbitrary requirement set by a well-meaning but wrong person.
I can't think of any solid security reason other than it discourages people from using actual sentences as passwords which would be very insecure if they had actual meaning. Strictly speaking, there is nothing insecure about a space in a password if it maintains good entropy, so people being "creative" is the only real thing that I can see.
There might also be a usability concern that spaces are hard to visually make sure you typed correct if the password is rendered visibly. (Is that one space or 4, granted if it appears a *s then it is easily countable.)
It’s a very good policy for convenience, and having seen this from the customer support side – I think this should be implemented everywhere.
You can write the password like this: “ abc def ghi ” and copy it to a piece of paper, or copy and paste.
It’s simply easier to strip all spaces than to keep telling everyone:
Which is usually an answer to the question:
its only about programmatic semantics. most everything handles the space character ' ' or " " different from other symbols like 'a' or 'dds'.
the blank space character gets lumped into other strange characters such as new lines - '\n' or blank characters - ''
It is also not unique, as some special characters on certain computer environments don't have a representation, and get parsed to a blank character ' '
In some computer environments where we were passing files back and forth from MAc to Windows to Linux, we sometimes ended up with (' ' == ' ') to produce a FALSE result (the double equals sign simply signifies a comparison operator). It was false because there were hidden symbols existing in the space that we couldn't see due to computer cultures being different across our team.
I am unsure whether or not this problem would ever occur when talking stictly passwords, but having no spaces in special areas such as passwords and function names and file names is defiantly the better way to go always. Parsing spaces in filenames is a whole different story, with some programs adding a % to a space to remove the space so you would have the name being the%name
On most keyboards, the Space key makes a sound that's slightly different from that of any other key.
Consider the scenario in which a person hears someone else type in their password.
If that person is able to figure out that the password consists of, for example, 3 characters + a space + 4 characters, that could be a very useful hint in some cases.
I believe most non-programmers feel (consciously or not) that the space character is essentially different from other characters in that it only serves to separate words from each other; being just metadata instead of data.
This feeling is strengthend by the fact that there is no sound corresponding to the space character. Most people remember their passwords in pronounced form (how they sound when spoken out loud) instead of the visual form (how they look like when written).
Therefore they would unconsciously consider "My Password", "My Password" and "MyPassword" to be the same because they are pronounced equally and they can easily see (thanks for the capital "P") where one word ends and the next begins -- even without a space. Of course, if you asked them whether those three are the same, you would lift the issue from the unconscious to the conscious mind and everyone would answer "no". But as long as nobody asks the question...
So the problem in allowing spaces in passwords is practical: it helps users to forget their passwords, i.e. help them forgetting whether there was a space (or two or three or...) in the password or not.
I can think of several reasons why spaces should be excluded; these reasons have nothing to do with security though but with usability:
If you transmit a password that have spaces in it, how does the recipient knows that it's a space or a tab? And is it one or two spaces? Assuming you have to hand-write it (it happens), how to show this information? Depending on the font of their email client, there's also a chance, they won't notice the blank space(s).
Again, when sending the password, if the spaces are at the beginning or end, it will be easily missed and will have to be enclosed in quotes. But even then it will look odd and I can easily imagine users not including this last space and being unable to login.
Blank characters (newlines, tabs, spaces) are often trimmed from the end and beginning of a field, to avoid people copying and pasting incorrect data. Obviously if the spaces were significant, that would cause a problem.
All in all, I think not having spaces avoid all kind of problems and saved support calls, so it is a good thing.
Edit:
To answer the comments about the bad practice of sharing passwords:
Let's say important business documents are locked on Bob's station, who is currently on vacation. What to do in this case? Wait for Bob to return two weeks later and lose potential business in the meantime? Or just ask him to send the password? It's Bad for sure but still better than the alternative.
As Linus Torvald put it (about something else, but I like the spirit): "you should deal with reality, not what you wish reality was".
I am going to qualify this comment by saying I have been a sysadmin for over thirty years... and a writer for at least as long.
Although using a space in a password may be allowed in some circles, and it may be more secure in the sense that you have a greater character set to harden your password with... you are asking for trouble by doing so. A space is not just a character, is it a representation of null space, just like a zero represents an absence of numerical value. The day will eventually come where you will “forget” the space and will pull your hair out wondering why your root password doesn’t work anymore and have to reload your server from scratch. From a useablility standpoint - I say keep away from the space... it’s one of those “unwritten rules” that you can give a hundred reasons not to obey but your life will be made easier by adhering to. In thirty years I only encountered one person who used a space in a password and it was hell trying to figure out. Others will disagree - and that’s their prerogative. I would never use a space.
In the first situation, it could lead to reading problems.
example: (someone sends)
user: username
password: secure!pass
actual_password: secure!pass[invisible space]
The space character can be added by mistake, or on purpose but it will be uncommunicated and also makes copy and pasting more hard, because they need to include the whitespaces.
When password is generated problem will occur that you might specify allowed characters for generation that will contain a space character. When user gets an e-mail with a password with a whitespace at the end or beginning, which would be problematic.
User might unknowingly hit space, and think that it doesn't matter that he did that as most programs don't allow spaces, he will be surprised on login. Other than this very questionable example there's nothing wrong with a space.
NIST 800-63B, it is note that space should be accepted in password, see pages.nist.gov/800-63-3/… Guess not everybody listen to them lol