0

Many websites have different requirements for a strong password (beyond simple length I mean). Anecdotally, I think these requirements are common:

  • Password must contain a mix of upper and lower case letters
  • Password must contain at least one number
  • Password must contain a special character like ()*&^%$£"- etc.
  • Password must be longer than 8 characters

I'm wondering what the most common requirements set by everyday websites are. Obviously this is impossible to answer definitively given the number of websites on the internet, but I'm wondering whether anyone has collected some amount of data gathering the modal password strength requirements? I was not able to find this from Googling.

1
3

... but I'm wondering whether anyone has collected some amount of data gathering the modal password strength requirements?

A Second Look at Password Composition Policies in the Wild: Comparing Samples from 2010 and 2016 from Usenix 2017 has collected password policies and strength requirements from many web sites. In this paper you'll find also links to related papers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.