65

I have just noticed that Google as well as some other sites trims the whitespaces in the password.

I can successfully sign into my google account even if I add extra spaces in the end of my password.

Is this behaviour intended or a bug?

I also tried some other sites, and I found out that many sites do such things.

I believe this is a very serious security issue, as some people may intentionally add spaces at the beginning or the end of the password to enhance the security.

Improve this question
5
  • 1
    On a related note, why does Windows think that Ctrl+Backspace is a valid character for a password?
    – oldmud0
    Commented Apr 2, 2015 at 0:55
  • @oldmud0 really weird behaviour!
    – Chip Zhang
    Commented Apr 2, 2015 at 7:25
  • 3
    I personally applaud them. I have been trying for years to figure out how to write a space character at the front/end of my password on the sticky note under my keyboard. Please don't ruin this for me. I'm calling Google as I type this comment and will tell them to not listen to this post.
    – MonkeyZeus
    Commented Apr 2, 2015 at 23:42
  • "I can successfully sign into my google account even if I add extra spaces in the end of my password". That's the reason for the trim: you already answered yourself.
    – Andrea
    Commented Apr 3, 2015 at 7:33
  • See also: ux.stackexchange.com/questions/8010/…
    – Dario Seidl
    Commented Feb 4, 2022 at 16:22

3 Answers 3

Reset to default
63

Good observation.

In my experience this happens for a number of reasons, some intentional and some unintentional.

Intentional reasons to trim whitespace:

  • Users often cut and paste passwords (yes, use of Notepad as a password manager really happens) and the paste operation for some clients adds a whitespace.
  • Phrase (multi word) passwords are increasingly used by people to increase the length of passwords, and users sometimes add a space involuntarily out of habit.
  • Mobile keyboard often add spaces after words. While mobile browsers are supposed to recognize the password control (eg type=password) and avoid doing this for passwords, they do not always do this.

Unintentional reasons:

  • Many apps use standardized form handlers (eg Ajax handler) which trim whitespace for fields by default, and developers may fail or be too lazy to override the behavior for passwords.
  • Passwords are often white listed to prevent illegal or unrecognized characters, and the regex matching sometimes trims the whitespace by mistake.
  • etc.

So there is no great answer here because the reasons really vary a lot.

But one thing is for sure....the inconsistent enforcement and the lack of site disclosure around this makes for a pretty crappy UX experience for users who notice, or who try to use leading or trailing whitespace!

Improve this answer
16
  • 2
    Hopefully the companies who do trim the spaces inform people during sign up (if they try to include a whitespace) that it is character they don't support. In which case it just benefits the UX for the reasons tohster mentioned e.g. copy and pasting or mobile keyboards
    – Chris
    Commented Apr 1, 2015 at 11:07
  • 14
    "Users often cut and paste passwords (yes, it really happens)" > well, how do you remember passwords for dozens/hundreds of servers ? You don't. You have a document with the passwords. And then you copy/paste these. And yes, you often get trailing spaces.
    – thomasb
    Commented Apr 1, 2015 at 14:00
  • 2
    @Falco any unexpected folding of a password (e.g. case-insensitive passwords for another somewhat common example) reduces the effective entropy and could influence the user's decision on choosing a password.
    – Random832
    Commented Apr 1, 2015 at 15:58
  • 10
    @cosmo0 use a password manager, its much more secure
    – Kyeotic
    Commented Apr 1, 2015 at 16:03
  • 14
    @cosmo0 no, a dedicated password manager will not have that issue.
    – Kyeotic
    Commented Apr 1, 2015 at 16:14
3

The simple answer is that it is *assumed that the whitespace was unintentional." I agree fully that spaces are very useful for increasing the password's entropy BUT I think this is a very useful compromise as many people cut and paste passwords and would be frustrated if they were not able to gain access to their site.

Re the issue of password security there are too many things that web sites do wrong as far as security is concerned. The most egregious one is limiting the number of characters for a password. (Assuming the passwords are not stored in clear-text.)

The simplest way to defeat dictionary and brute force attacks is by increasing the number of characters in the password.

Even if the system doesn't allow special characters a 62 character set (lower case, UPPER CASE, 0-9) is, for all practicable purposes unbreakable with 16 characters.

1 Trillion attempts / sec (as per Snowden) times 3/4 of a billion seconds in a year. Is roughly 10^19

A 16 character password is roughly 10^30; which is, as far as I can tell, unbreakable.

Improve this answer
7
  • 1
    There's more to it than just length, though. A password like passwordpassword is probably not unbreakable just because it's 16 characters long.
    – user43787
    Commented Apr 1, 2015 at 23:35
  • True. I simplified it a bit. :-) You need to avoid dictionary attacks which can be remembered by passphrases. "This is my super secret message that only I know" becomes "thimsusemethonikn." (the first two letters of every word. First letter if there are two or less letters in the word). That should be a safe password. There's enough entropy and it cannot succumb to a dictionary attack.
    – Mayo
    Commented Apr 2, 2015 at 1:15
  • To add to your answer, I've always used xkcd.com/936 to explain entropy to people. All this lower case, upper case, l33t speak, numbers, etc. is a joke for security. All that matters is length. Over 21 characters (since hashes are 7 characters) and you are safe.
    – Code Maverick
    Commented Apr 2, 2015 at 15:08
  • 3
    People should stop thinking in terms of calculations per second and start thinking in terms of physical limits: we can't really know just how fast computers will become in the future and there are many things I encrypt today which 20 years from now I would still not want to be decrypted. If we take a 25-character ASCII (95 printable character) password we get about 10^49 combinations; if we consider just the energy to merely write each combination to be only 1eV, well below the theoretical minimum, it would take 10^28 J to crack, in other words, the KE of the Moon's orbit. Futureproof.
    – user64266
    Commented Apr 2, 2015 at 17:32
  • @thepowerofnone "The bad news is, in two and a half hours the moon will crash into the earth. The good news is, I got my Tumblr account back."
    – Sneftel
    Commented Apr 2, 2015 at 21:29
3

This behavior should not pose any issue. The sites that trim passwords will trim them both on initial entry and on use, those that do not will not. If you use spaces in your password, and they are trimmed out, you won't even notice.

Using spaces in the password does not enhance security any more than using any other character instead of space. But knowing that a site trims passwords could enhance security: if someone is watching you type your password, thrown in some extra spaces to distort their observation without actually distorting your password.

Improve this answer
4
  • 2
    and they are trimmed out, you won't even notice. -- ...until you forget the space, are granted access and go "wtf, that wasn't the right password".
    – aioobe
    Commented Apr 2, 2015 at 13:01
  • 1
    "if someone is watching you type your password, thrown in some extra spaces to distort their observation" At best, this is security through obscurity. One must assume that the attacker knows the rules for password hashing on the system if you also do.
    – Tyzoid
    Commented Apr 2, 2015 at 18:56
  • 2
    "thrown in some extra spaces to distort their observation" -- how does that work? If they observe and remember a sequence of key presses that successfully logs in, can't they later log in by repeating that sequence, regardless of whether some of the keypresses were insignificant? You might as well press the CTRL key a couple of times to "distort their observation". Chances are either they can watch you type or they can't, the space bar isn't going to blow their tiny mind ;-)
    – Steve Jessop
    Commented Apr 3, 2015 at 0:37
  • 1
    Kind of OT, but it could theoretically work if you add so many spaces that the thing becomes too long too remember: "__p____a__s_____s___W...oh I give up". No, it's implausible really.
    – Steve Bennett
    Commented Apr 8, 2015 at 1:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.