User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is current practice when it comes to localization of passwords? I know many systems, even where Latin/romanised text is not used, do not recognize/accept two-bit/unicode passwords. My instinct is to make unicode characters available for passwords, but am not sure if there is sufficient server support for such a requirement.

share|improve this question
Any server should allow Unicode input. If it doesn't, it's broken. And passwords are stored as salted hashes, which usually means some subset of ASCII (often hex strings). So it shouldn't really be a problem. Disallowing strong passwords is bad. – TRiG Dec 12 '12 at 20:31

Unicode is a computing industry standard for the consistent encoding, representation and handling of text expressed in most of the world's writing systems.

Quote from Wikipedia page on Unicode.

That says it all, doesn't it?

share|improve this answer

You should let people use whatever is natural to them for input, and that means accepting Unicode. If someone is Russian, forcing them to use ASCII characters is a poor UX.

If they enter their password in a particular character set, it's their responsibility to make sure that they are typing in that character set when they enter it again later. I can't see a lot of people complaining about this, as for people that deal with multiple character sets, it's normal to deal with this. However I can see a lot of people being frustrated that you are forcing them to use a character set that they either don't have on their keyboards, or simply don't know.

The final reason is that it is better security if people are allowed to use Unicode characters in their password.

share|improve this answer
Then the problem becomes one of evaluating the password's complexity, as many security standards originating in anglophone countries are written assuming what is now called the Basic Latin block. It may require that, for instance a password contain one Basic Latin uppercase letter, one Basic Latin lowercase letter, one Basic Latin digit, and one Basic Latin punctuation mark. – Damian Yerrick May 19 at 12:34
@DamianYerrick That isn't really a UX issue, it's a security policy issue. I have yet to see a situation where trying to enforce a given level of password complexity ends up with better security. Usually it results in someone reusing a password they already know, or writing the password down. – JohnGB May 21 at 17:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.