Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

What is current practice when it comes to localization of passwords? I know many systems, even where Latin/romanised text is not used, do not recognize/accept two-bit/unicode passwords. My instinct is to make unicode characters available for passwords, but am not sure if there is sufficient server support for such a requirement.

share|improve this question
5  
Any server should allow Unicode input. If it doesn't, it's broken. And passwords are stored as salted hashes, which usually means some subset of ASCII (often hex strings). So it shouldn't really be a problem. Disallowing strong passwords is bad. –  TRiG Dec 12 '12 at 20:31

2 Answers 2

Unicode is a computing industry standard for the consistent encoding, representation and handling of text expressed in most of the world's writing systems.

Quote from Wikipedia page on Unicode.

That says it all, doesn't it?

share|improve this answer

You should let people use whatever is natural to them for input, and that means accepting Unicode. If someone is Russian, forcing them to use ASCII characters is a poor UX.

If they enter their password in a particular character set, it's their responsibility to make sure that they are typing in that character set when they enter it again later. I can't see a lot of people complaining about this, as for people that deal with multiple character sets, it's normal to deal with this. However I can see a lot of people being frustrated that you are forcing them to use a character set that they either don't have on their keyboards, or simply don't know.

The final reason is that it is better security if people are allowed to use Unicode characters in their password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.