For a commercial web site, is it important to impose some restriction on passwords to access the system?

Eg. special $char, Upper and lower case, numbers, at least a minimum length...

Can a CAPTCHA system be sufficient to substitute password restrictions?


CAPTCHA systems are in no way a replacement for a good password policy. They aren't tackling the same problems.

CAPTCHA systems only help when someone is attempting an online attack against your system. If your application has some hole that allows an attacker to dump a database full of password hashes, placing a CAPTCHA on every page won't do anything.

Have strong, but reasonable password policies to restrict users from using hilariously weak passwords.

  • Especially have a reasonable policy. Anything over 5 characters would be enough in my opinion. If you use the password abcde, that's your own stupid problem when my database gets hacked. I'll implement ratelimiting for login attempts so that you can't hack my service by trying for weak passwords. But I should be able to choose ^[ -~]$ as password which contains neither digits nor lowercase nor uppercase. I think it's stronger than the average "s3cur3pa$$word". – Luc May 8 '13 at 19:23

If you maintain a Web site in which users can sign up and protect their account with a password, then you should edict a policy of minimal password length -- and, please, nothing else. Stricter rules, more often than not, backfire. For proper security, you need to enlist user cooperation, which will exist only on a voluntary basis. The more you enforce, the less users will be willing to help. Making users Angry is already a quite dumb move when users are customers (you don't want to repel customers, do you ?), but for security it is deadly.

A salient point is that the password is not meant to protect you, but the user himself. Be sure to make it known to the user. Education is the key, not coercion.

Besides policies, you can provide some useful tools, e.g. an automatic password generator -- nothing too drastic, say 8 characters (I am quite fond of passwords consisting of two letters, then two digits, then two letters, then two digits: such passwords, like 'ke89fz44', are not too hard to memorize, and still offer a non-ridiculous amount of entropy, a bit above 32 bits, which is more than can be hoped for when users choose "randomly" in their head).


I would think that you should enforce some level of password requirements. If your password hashes get compromised and some unfortunate soul used password123 as his password, his account could be compromised very quickly even if the passwords are hashed and salted. A human attacker with the plaintext password and the username could easily just fill in the CAPTCHA. CAPTCHA is more useful for deterring automated attacks or for preventing bots from registering a ton of accounts.


Captchas can be cracked using automated tools. Complex passwords make it harder for attackers to brute-force password attempts and helps to reduce the number of 'common' passwords.

Password policies should be in place for web sites, no question. Work with your users to determine a policy that makes sense.

Sometimes a super-secure password policy can give the website an image of security and stability, which can affect a user's impression of the site. Or, an inconvenient password policy can turn users off. Finding a balance is a trick, and is THE trick for security (balancing usability with security).


No. You should use federated logon and avoid the entire problem. Select an identity provider who matches or exceeds the risk level of the information you're protecting. Let them worry about passwords.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.