Should users be allowed to entered a password with a space at the beginning or end?

Question

Should users be able to enter a password such as " 12345" or "12345 "--a space at the beginning or the end? Or would you trim the password to remove these spaces because it's probably just a typing error.

Answer 1

Yes, they should.

• It annoys me to no end when people decide how my password should behave especially when it's nonsensical. I would like more than 8 characters please.
• You should be hashing the password, so maximum character lengths and spaces at the end don't matter.

No, you should not trim it.

• You require a user to enter the password twice (when creating it) to eliminate typing errors. Therefore a space doesn't matter.

Answer 2

You should validate the password with a confirmation field anyway. If they make the typo twice - then you hopefully have a forgot password or a reset feature in place.

The space shouldn't matter as you shouldn't be storing it in plain text.

Answer 3

Let me tell you a story.

I needed to create an account on an ecommerce site, so I ran my random password generator to make an 8 character upper/lower/number/punctuation password, pasted it in twice to confirm it, finished registering with all of my personal information, and saved the random password in a local PGP-encrypted file for later use.

Later on I tried logging in, but pasting the password again didn't work. After a bit of testing, I was horrified to find that the site had stripped out all punctuation marks from the original password, in some misguided attempt at sanitization, reducing my password to three easily brute forceable letters.

DON'T trim or sanitize users' passwords.

Answer 4

Since it's bad juju to store the password as text, there's no need to trim() the password since it'll immediately be hashed.

... on a similar note, am I correct in believing that passwords shouldn't need to be regex validated to for sql injection since they'll be hashed and not inserted as plain text in the database?

Answer 5

Never "clean up" a password simply to account for "typing mistakes". This will confuse users and in some cases make it impossible for them to login. In fact, don't ever change a password behind a user's back...always warn them that a password is invalid and let them try a new one.

A good example that I recently ran into was with a 3Com switch. The web interface allowed me to change the admin password, but didn't warn me that the password was limited to eight characters. I entered a password that was longer than eight characters. When I tried to login after the change, it simply rejected my password. If I only used the first eight characters, however, I was able to login (trial and error on my part, not fun).

Passwords these days don't look the way they used to. For instance, my passwords often look like this:

Man, this program is really ticking me off!

Answer 6

The moment you make such a decision is the moment you start walking down the path of micro-management (over your users in this case).

Does a password containing a space break your system? Or is it a security risk? Then don't worry. Let your users deal with their own errors, even if that means they have to get frustrated. Their typo should never be your problem.

Answer 7

I don't care. So long as whatever you do to the password when it is being set is also done to it when being entered later on. Trim, truncate, change case, salt, hash, whatever - just do it consistently.

Presumably you aren't storing the actual password anyway, so...

Answer 8

Space is a regular password character, and you shouldn't remove it.

Since you probably hash the password before storing it in the database, the space will be treated as any other character.

Answer 9

It is fine for the password to contain it as already mentioned however I would add that when generating new random passwords (say for a sensible reset lost password system) you should avoid generating ones containing such tricky characters.

If the password is sufficiently long and random then this will make up for the restriction of a few tricky characters will make the end user's life considerably easier...

Answer 10

I've been to a conference more than once where someone logged in to their account for a demo after the computer display was already up on the big screen, didn't change focus to the password field correctly, and thus their password was revealed to the entire audience.

Anyone who might have to enter credentials in front of others should consider keeping a trailing space or three in their password, just in case. And when building authentication systems, you should never trim those spaces.