I am the primary developer of a website. During a recent security audit, we got dinged because we display our password standards on the login page.

My contention is that revealing this information does not significantly affect the security because the amount of passwords this information allows a potential hacker is insignificant compared to the total number available.

For example, stating that the password must be at least 8 digits allows them to skip trying all passwords less than 8. However, even compared to just the number of passwords you can create with 8 characters (let alone 9, 10, etc) the number of passwords you can create with 7 or less is tiny. Same principle extends to including numbers, upper case, lower case, etc.

This percentage grows smaller and smaller the longer the password is able to be. Since we do not limit the length of the password, the impact of revealing the requirements is insignificant, bordering on non-existent.

Or am I missing something?

  • 1
    Also, this isn't typically something an informed auditor would report.
    – PwdRsch
    Aug 31, 2017 at 15:57
  • @PwdRsch dang it, I tried to search to see if it had been asked but didn't find that one.
    – Kevin
    Aug 31, 2017 at 15:59


Browse other questions tagged .