Recently I was asked to change a password, along with a password policy which reqires you to use a digit, a special character and a letter, but forbids any letter from you log in name to be used for the password, does this increase security? To my eyes, it shrinkens the set of available characters and therefore increases the probability of a possible match in a brute force attack. Am I right, or do I miss something?

If this is a default (as I was told) it will be publicly known that this application expects passwords to fulfill this restriction.

  • Can one sign up with [a-z] account name there? If yes, how should one use a mandatory letter in password when all of them are used in username? Commented Apr 9, 2013 at 9:14
  • 3
    This does sound pretty dumb. Not allowing the full username in the password is fine, but not allowing any letter from the username is ridiculous.
    – Polynomial
    Commented Apr 9, 2013 at 9:30
  • 2
    If the attacker knows the username he will have a smaller set of characters to use brute force
    – Shurmajee
    Commented Apr 9, 2013 at 9:46

2 Answers 2


Anything that restricts the set of possible passwords makes it more vulnerable to a brute force attack. The only reason to forbid some passwords is if the restriction to the password space is compensated by the high propensity of users to pick passwords that can be easily guessed.

Let's say you would like passwords with at least 38 bits of entropy (that's already very high for a password that can only be attacked online under normal circumstances). That requires a password space of at least 274877906944.

Forbidding passwords that are too short is reasonable. Assuming the character set is restricted to the 94 ASCII non-space printable characters, 6 random characters are the minimum (689869781056). Forbidding shorter (≤5 characters) passwords barely makes a difference: there are only 7417954634 of them — the passwords of length 5 or length only make up 1.1% (a little over 1/94) of the passwords of length up to 6. And because users rarely pick completely random sequences of characters, it makes sense to have an even higher minimum length. A minimum length barely makes a dent in the password space, because it grows exponentially.

Forbidding a character, conversely, makes more and more of a difference as passwords get longer. Let's say you pick a password with 8 random letters and a random digit at the end (and don't rely on the punctuation character for entropy). That gives 2088270645760 possibilities — over 241, meeting the 38-bit requirement. If you forbid as little as one letter, the password space shrinks to 1525878906250 — that's 27% of the password space wasted right there. With 6 forbidden letters, the password space shrinks to 256000000000 which is less than 238.

Random letters are hard to memorize, so there are better methods to generate longer but more usable good passwords. corrEct horSE battEry StapLE? Nope, I can't use that. Let's take the popular Diceware list of 7776 English words and memorable letter and digit sequences. 3 random items on the list satisfy the 38 bits requirement (77763 = 470184984576). But 3 random items that don't contain any letters of my username? Only 2130 items fit the bill, leading to 9663597000 possible passwords, only 33 bits. Still decent, but less than our target. And the Diceware list has an annoyingly high number of special characters if you're going to type that password on a mobile device. I have a list of 4172 short, common English words, and can pick 3 random words to get 37 bits of entropy, which with an added digit gives the required 38 bits (726160964480 possible passwords). If I exclude letters in my username, that drops to 787 words, for only 29 bits with no digit or 33 bits with a digit.

Forbidding common characters for users who deliberately pick good passwords is bad, and I've bored you with the math to show it. What about the users that password restrictions really target — the 99% who don't pick randomly?

Girlfriend's name? No. Mother's maiden name? No. Hometown? No. Damn, this is difficult, the restriction must be working! paSSword1? Swordfish1? qwErtyuiop1? Ah, zxcvbn1 works for me, how lucky.


Does it really forbid every letter you use in your username? You are right that this is bad as it reduces the pool of potential passwords by quite a considerable amount. Please name and shame so I can stay as far away from this application as possible.

A more common scheme is not allowing passwords containing your username, first name or some other piece of publicly available information linked to your account. This is a good measure as it makes a targeted attack against your account slightly more difficult.

  • could also be a substring of the username (e.g. can't use "dog" in password if username is "dogman")
    – TruthOf42
    Commented Apr 14, 2014 at 20:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .