# Are limited length passwords a security risk? [duplicate]

This question already has an answer here:

I found a webpage where users can be registered. However, it seems that the length of the password must be between 6 to 12 characters.

Is that a security risk?

## marked as duplicate by Ohnana, Matthew, Graham Hill, Steffen Ullrich, Deer HunterMar 21 '16 at 7:28

• I don't think that the linked questions are duplicates. The first one is asking if there are problems with not having a maximum password length, the second is asking what reasons there are to have a maximum password length. Neither is asking if it is a security risk to have a (low) maximum password length. The answer is obviously yes, so it's not an interesting question, but not really a duplicate either. – tim Mar 12 '16 at 17:36
• Just out of interest, which website was it? – Greenonline Mar 13 '16 at 8:55

Yes. Passwords are by nature very prone to be mishandled, and most decisions taken about its management are arbitrary or have more grounds in function than in security. In particular, any measure that trim the possible password space are particularly bad.

One example is ATM PINs. They have only 4 digits (in most cases, at least), so most of their strength relies on the fact that retries are limited. So, for a normal scenario, you have 3 tries to guess a value out of 10000. That means a probability of success of 1/3333. Humans are terrible at randomness, and as a result some PINS are more likely than others: 1111, 1234, and so on. As a result, some banks introduce rules: not repeated numbers (now you have only 5040 possible PINs), not math sequences (1234, 2468... how many of those can you build?), not keyboard patterns (L shaped PIN, a straight line, etc.). After you blacklist so many options, the attacker has now a much smaller search space to guess, and the probabilities are more favorable for them.

For a more open environment (higher capabilities for the attacker), there are lower limits that make sense, since a dictionary attack is almost trivial for short passwords. Some would say 8, some would say 10, but nobody would say 6 is reasonable. If the passwords are hashed (and salted), it comes a point where longer passwords have no increase in security, but it makes little sense to put a limit on them.

In addition to looking at the entropy of a short password the way the other answers have, you should consider why the site has a restricted password length. There's no valid technical reason for a modern website (or almost any other authentication system) to have a maximum password length (at least, not one any human would ever exceed by accident). Passwords shouldn't ever be stored anywhere in any form except briefly in RAM; they should be run through a Key Derivation Function (the most popular ones are called scrypt, bcrypt, and PBKDF2, in descending order of difficulty to crack) and the resulting key should be stored in the database along with the salt and other KDF inputs (aside from the password, obviously) necessary to derive said key. KDFs don't care how long your password is; they'll produce a constant-length key in any case.

So yes, you should be very suspicious of any site that enforces a maximum password length.

• `bcrypt`'s limit is 81 (which is a valid technical reason), btw you should be using Argon2 nowadays... – wb9688 Mar 13 '16 at 19:50
• Fair enough. 81 is arguably into the "[no] human would ever exceed by accident" range, though I put that in there more for things like "might crash your browser trying to POST more than 2GB of data". I'll check out Argon2, thanks! – CBHacking Mar 14 '16 at 7:56

Yes, it is a security risk.

The length of your password greatly affects your accounts security.

Assuming a website only allows lower-case letters [a-z] and limits your password to 1-4 characters.

It will only take 26^4 (456,976) different permutations. Hence, it will only take a maximum of 456,976 different trials to determine your password.

If you increase its length to 12 characters, there will be a maximum of 26^12 (9.54 x 10^16) different permutations.

To put it simply, the length of your password is definitely a factor in your account's security. The longer your password is the greater the security.

If you have no choice but to settle with a limited length for you password....

Here are some ways to make your account much more secure to bruteforcing