As @Adnan aptly point out, there is no good reason to restrict characters, but the practice isn't going to go away soon.
One of the most egregious examples of such restrictions is what is done in the x-cart shopping cart system that many websites use. It silently truncates passwords are <
. So if you give it a password like lwB<Ln#q5iDVnW!K&ZQ0u(zD
, it will treat your password as lwB
. Steve Thomas has described this, but I can't find the precise source, so I will just credit him in general.)
It is clear from errors like this what the original intent was. Someone threw in a password parsing rule to prevent XSS. Obviously there are much much better ways to doing this, but this shows that some of these policies are an attempt to sanitize user provided data before doing any further processing of it.
US-ASCII only
There are good reasons to restrict passwords to US-ASCII. A user may have something like ü
in their password, but sometimes they will be providing that as UTF8 and other times as Latin1 (or any other set of encodings). The user may be unaware of such distinctions.
Allow whitespace?
There is some debate about whether white space should be allowed in passwords. I'm in favor of allowing spaces as it can be useful for creating stronger, more memorable, and easier to type passphrases. But there are two reasons to be wary of spaces in passwords.
Spaces are very audible when people are typing.
On most keyboards it is easy to hear when a space versus any other key is typed. Thus someone who hears you type in your password a few times will be able to learn in which positions there are spaces. This can make cracking much easier.
Stripping trailing and leading whitespace.
We may wish to strip trailing and leading whitespace from entered passwords, as people may not know that those are there. (Possible copy/paste sloppiness, etc). So we just add confusion if we say that white space is allowed as long as it isn't trailing or leading.
Despite these problems, I still like the idea of allowing spaces. But a lot of smart people disagree with me.