36

Should users be able to enter a password such as " 12345" or "12345 " – a space at the beginning or end? Or would you trim the password to remove the leading or trailing spaces because it may just a typing error.

3
  • Google and Microsoft appear to be trimming passwords so the idea doesn't seem far-fetched.
    – antak
    Aug 18, 2016 at 3:12
  • 1
    10 years late... but this answer offers good trade-off... ux.stackexchange.com/a/8020/67374 (basically, don't trim the password, but on login, if the password fails, silently try again with a trimmed password). Win-win situation. Jan 28, 2019 at 7:33
  • 1
    Never ever change the typed password!
    – Lazarus
    Jul 24, 2020 at 11:20

11 Answers 11

67

Yes, they should.

  • It annoys me to no end when people decide how my password should behave especially when it's nonsensical. I would like more than 8 characters please.
  • You should be hashing the password, so maximum character lengths and spaces at the end don't matter.

No, you should not trim it.

  • You require a user to enter the password twice (when creating it) to eliminate typing errors. Therefore a space doesn't matter.
16
  • 6
    I think it's time we stopped worrying so much about the small few people that are too dumb to accidentally put a space before their password, twice, and write it down (bad), and then forget it. They earned it, imo.
    – GManNickG
    May 17, 2009 at 22:13
  • 22
    I disagree to this. When typing their password for logging in, someone might copy and paste it, which adds an extra whitespace here or there. If you don't trim this in your login processing code, they won't be able to login even though to them the password is exactly the same. Especially if your audience is non-technical. So no, spaces shouldn't be allowed.
    – Ali
    May 18, 2009 at 0:12
  • 2
    @Click that's a very good point. I think it's one of those tricky situations. If I had unlimited resources I would detect a paste event versus a type event, and display a message that there was a space at the end of a paste.
    – Tom Ritter
    May 18, 2009 at 18:05
  • 7
    @TeeJaay That's a horrible idea. Loads of people generate something like a 15 character password - you can't expect people to slowly type those out.
    – Tom Ritter
    Aug 21, 2014 at 14:53
  • 2
    @Tom you are right, thought about it and i must agree I don't know what I had to drink that day.
    – TeeJaay
    Sep 2, 2014 at 4:59
43

Let me tell you a story.

I needed to create an account on an ecommerce site, so I ran my random password generator to make an 8 character upper/lower/number/punctuation password, pasted it in twice to confirm it, finished registering with all of my personal information, and saved the random password in a local PGP-encrypted file for later use.

Later on I tried logging in, but pasting the password again didn't work. After a bit of testing, I was horrified to find that the site had stripped out all punctuation marks from the original password, in some misguided attempt at sanitization, reducing my password to three easily brute forceable letters.

DON'T trim or sanitize users' passwords.

8
  • 8
    Good story, not quite sure it's completely related, but good for people to know/see. Mar 10, 2009 at 20:45
  • 4
    I consider it related - he's talking about altering the user's password, so that password attempts that will be accepted are different than (and possibly easier than) what the user may intend. Mar 10, 2009 at 20:46
  • Seems directly related to me.
    – mqp
    Mar 10, 2009 at 20:48
  • Okay, "completely related" meaning that it isn't about a password, but instead about password validation in general, which is what the question has ended up being about. Still +1 for a great answer. Mar 10, 2009 at 20:58
  • 2
    I agree 100%. Except in the case of leading and trailing WS, which is just an accident waiting to happen... :)
    – EML
    Jan 23, 2022 at 14:49
20

Never "clean up" a password simply to account for "typing mistakes". This will confuse users and in some cases make it impossible for them to login. In fact, don't ever change a password behind a user's back...always warn them that a password is invalid and let them try a new one.

A good example that I recently ran into was with a 3Com switch. The web interface allowed me to change the admin password, but didn't warn me that the password was limited to eight characters. I entered a password that was longer than eight characters. When I tried to login after the change, it simply rejected my password. If I only used the first eight characters, however, I was able to login (trial and error on my part, not fun).

Passwords these days don't look the way they used to. For instance, my passwords often look like this:

Man, this program is really ticking me off!
2
  • 1
    That reminds me of a bad experience i've had with Windows passwords now on several occasions. I'll build a machine, configure the admin password, and then join it to the domain. The domain imposes password complexity rules that my password doesn't match. Now i can't log in to the admin account. Bah.
    – Shog9
    Mar 10, 2009 at 20:49
  • 2
    Back in the dark ages, I had this problem with my AIM account which was an AOL account. Through AOL, I could use my full password, but apparently it just truncated to 8 chars behind the scenes every time, as when I started using stand-alone AIM, I couldn't login until I tried only 8 chars.
    – rmeador
    Mar 10, 2009 at 21:06
8

You should validate the password with a confirmation field anyway. If they make the typo twice - then you hopefully have a forgot password or a reset feature in place.

The space shouldn't matter as you shouldn't be storing it in plain text.

7

The moment you make such a decision is the moment you start walking down the path of micro-management (over your users in this case).

Does a password containing a space break your system? Or is it a security risk? Then don't worry. Let your users deal with their own errors, even if that means they have to get frustrated. Their typo should never be your problem.

2
  • 3
    You should micromanage and measure your user experience. Spin the dials, pull the levers and see what sticks! "Let your users deal with their own errors, even if that means they have to get frustrated" this attitude lacks empathy and not a path I would recommend. Mar 10, 2009 at 21:15
  • 1
    @jms: So you enjoyed using the paperclip in Office, I presume? Mar 10, 2009 at 21:27
6

Space is a regular password character, and you shouldn't remove it.

Since you probably hash the password before storing it in the database, the space will be treated as any other character.

5

I'm voting for: No, they shouldn't:

There's a big benefit for not allowing users to use spaces at the beginning and end of passwords and that's simply that it eliminates the problem which often arises when a user copies and pastes their password (e.g. from an email) and it includes white space which isn't part of the password.

The user then gets frustrated, thinks the system is broken and contacts support. A developer is promptly pulled onto the project to check the "buggy" login process only to spend a day pulling out his/her hair until he/she realises the problem.

I think enforcing this policy when creating a password solves more problems than it creates.

8
  • You should use a double input for that case, because a trailing or leading space is still valid and for the edge case, where a mistake is made twice, you can reset the password. A password should never be seen after the very first entry, so it pretty much doesn't matter what chars are used. Dec 9, 2014 at 16:26
  • The annoyance I've seen happen a number of times before is when a user has their password stored in a text file or an email or whatever. They then copy and paste this to login (not for signing up). So, sadly the double input isn't applicable in this case. Maybe it's an edge case and I've been unlucky?!
    – Lee Gunn
    Dec 9, 2014 at 18:42
  • No, I don't think you have been unlucky, I think you're dealing with normal users (nobody who knows anything ever sends a password through email) Thats fine for login, but when creating a password, you should prevent copy & paste. Dec 9, 2014 at 22:06
  • @BrillPappin - I cannot think of a case, where a double input would solve the problem. Either they copy paste the password from somewhere, then they do it twice, or they enter it by hand and hardly make such a mistake. On the other side, it is my opinion that the strongness of a password should not depend on leading spaces/tabs. A password generator will never create such passwords, and the worst case is that you loose the strength of 1 character of the password (if the minimum length is checked after trimming i cannot see any problems). Dec 10, 2014 at 8:57
  • @Lee - You still need to allow spaces as they are valid chars. The point is not to force the user to make a weaker password, or to modify the password without them knowing. It would be far better to give them an error asking them to remove leading or trailing spaces than to trim them. Dec 10, 2014 at 14:36
3

It is fine for the password to contain it as already mentioned however I would add that when generating new random passwords (say for a sensible reset lost password system) you should avoid generating ones containing such tricky characters.

If the password is sufficiently long and random then this will make up for the restriction of a few tricky characters will make the end user's life considerably easier...

3
  • I generally avoid generating password where possibly, but instead have the user click a link to enter a password if they forget the existing one. One when the admin creates the account is a password generated automatically. Mar 10, 2009 at 21:20
  • @DarrylHein How is sending a link any better than sending a password the user has to change immediately after logging in to use it? If a bad actor intercepts the email with the link it will have exactly the same effect as if they got the one-time password. I don't see how adding complexity to the system to handle password reset links adds to security - if anything, it lowers overall system security because there are more places that can break. Jun 27, 2017 at 6:34
  • @FKEinternet I agree that it's not 100% better than sending the password, but you can do 2 things to help: (1) only allow the link to be used once and (2) put a time limit on how long the link works. This will at least prevent someone from finding the user's password in their email at a later date. If using their email for verification and someone has access to their email account, I think you're hooped no matter what. I've seen many links and temporary passwords never changed. Jun 27, 2017 at 15:41
3

I've been to a conference more than once where someone logged in to their account for a demo after the computer display was already up on the big screen, didn't change focus to the password field correctly, and thus their password was revealed to the entire audience.

Anyone who might have to enter credentials in front of others should consider keeping a trailing space or three in their password, just in case. And when building authentication systems, you should never trim those spaces.

2
  • 2
    Hmm... How long d'ya think it'd take you to guess my password using trial-and-error, if you knew EVERYTHING about it, except for how many spaces i'd tacked on to the end. Including how long it takes me to type it... Hope the guy in your story changed his password after the demo!
    – Shog9
    May 18, 2009 at 0:41
  • 4
    No idea: I didn't know the presenters. From the standpoint of the hacker, if I didn't know they had appended spaces I would likely assume it had changed. From the standpoint of the presenter I would be hoping it bought me enough time to get through the presentation before changing it, even if the hacker is sitting in the audience with wifi. May 18, 2009 at 0:53
2

Since it's bad juju to store the password as text, there's no need to trim() the password since it'll immediately be hashed.

... on a similar note, am I correct in believing that passwords shouldn't need to be regex validated to for sql injection since they'll be hashed and not inserted as plain text in the database?

3
  • I think you'd be correct on the later, except when you using MD5() or something similar directly within within SQL. Mar 10, 2009 at 20:45
  • 2
    No input should be regex-validated at all. Just escape all problematic letters. Mar 10, 2009 at 20:56
  • @Darryl, Thanks to Jeff's blog, I'm going with SHA256. Mar 10, 2009 at 21:01
2

I don't care. So long as whatever you do to the password when it is being set is also done to it when being entered later on. Trim, truncate, change case, salt, hash, whatever - just do it consistently.

Presumably you aren't storing the actual password anyway, so...

5
  • Good point...checking code... Mar 10, 2009 at 20:48
  • Word. Users are always cutting and pasting text and that last space gets them every time. Trim it, be consistent and don't bother me with it. Mar 10, 2009 at 20:51
  • 4
    Except that you are potentially decreasing the complexity of the password without warning the user. These days people tend to think about things like that.
    – Boden
    Mar 10, 2009 at 20:52
  • 1
    @Boden: if you care about strong passwords (and you should) then enforce rules that specify sufficient characters and length needed to make a strong password. If you think it'll make things more usable, then trim. They're not mutually exclusive, so long as you are consistent.
    – Shog9
    Mar 10, 2009 at 20:56
  • NO!!! Do not change a user's password entry - use the entry as-is. Whatever post-processing you do before storing a representation of it in the database - e.g., hashing as a good example - do that consistently - but use the entry exactly as the user entered it. Anything else you do is going to just result in trouble - reread the stories told above by @Josh Kelly and Boden again, and if you still don't get it, reread them until you do! Jun 27, 2017 at 6:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.