0

If this isn't the right forum, I apologize, but here goes...

I'd like to make a password-generator - strictly for myself. I'd like four "levels" of characters, but I'm a bit unsure of which symbols should be in each of the three latter ones - since I don't know which symbols sites are likely to disallow. I know this is somewhat a question of "personal opinion" - but lets call it "experience" instead...

I'm not going to use any accented letters, letters from other alphabets (Greek, Cyrillic, ...), letters only used in a few countries (like letters specific to Scandinavia or Poland), or special symbols (like "masculine" or "upside-down question mark"). So please ignore these...

My four "levels":

  • Upper-and lower-case letters, and digits
  • Symbols, "always" allowed (if the site accept symbols in passwords, it accepts these)
  • Symbols "usually" allowed (if the site allows more than the very minimal of symbols, it allows these too)
  • Symbols "sometimes" forbidden (in the rare case some symbols are not allowed, it's usually some of these)

(...And while not applicable to my password-generator, are there any symbols that are almost always forbidden for various reasons?)

As for the fourth group, I'm particularly thinking of symbols likely to do "Bad Things" to PHP/ASP/JSP-scripts, JavaScript, HTML/CSS and SQL; and thus are often forbidden.

  • 2
    Yeah, this is unanswerable. You are asking for lists are characters that have various likelihoods of being accepted by a random site. – schroeder Mar 27 '17 at 14:35
  • 1
    Frankly, I'd go to the sites you use and build the lists yourself. I'm not sure a "community effort" will end up being helpful. – schroeder Mar 27 '17 at 14:36
  • 3
    Why don't you just use alphanumeric (i.e. [0-9a-zA-Z]) characters? With long enough passwords, you do not need more. If you really want more, you can use the list of the 95 printable ASCII characters. – A. Hersean Mar 27 '17 at 15:03
  • 1
    I'd go the other way and get rid of some of those pesky letters and digits too. I never really liked alphanumerics such as 0 or l. – daniel Mar 28 '17 at 16:03
  • 1
    Why have "levels" at all? Just allow the user to configure at run time exactly which characters are allowable and which aren't. If you're just writing this for personal use (i.e. not as an exercise, but to actually use) why not use one of the existing password generators available (I use Password Safe and it has highly customisable generator profiles) – Maybe_Factor Mar 29 '17 at 5:09
2

According to OWASP, which uses references from Microsoft AD, and Oracle Identity Manager, these symbols are allowed.

!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

https://www.owasp.org/index.php/Password_special_characters

However, I suppose that only answers your "usually" question. OWASP further explains that "Various operating systems and applications may apply limitations to this set".

Which to me says, it's completely subjective. Meaning, if I'm an application developer, I can choose to utilize industry standards (OWASP), or use my own subset.

So, to answer the "always" question, I think it would be safe to assume that these are acceptable.

!#$%&()+-/:;@[\]^_|~

Additionally, given the above information, I would go with these as the "sometimes forbidden" options.

"$%'()*+,-./:;<=>[]`{}

Since this is somewhat of a subjective question, no answer given can be 100% accurate. I think this should help with your task though..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.