*Note: I'm using an inline validating message, where if a user enters a char that is not allowed a message is displayed (i.e. "Please only use...")

I've seen this post about stating valid characters without introducing too much clutter.

But I have a password regex that includes:

  • 0-9
  • a-z
  • A-Z
  • `~!@#$%^&*()-_=+,<.>/?;:'"[]{}|

And it seems like it would be bad form to include all the symbols in a UI message.

Valid characters are A-Z a-z 0-9 `~!@#$%^&*()-_=+,<.>/?;:'"[]{}|

Is there a way to specify "all keyboard symbols"? Something like "Valid characters are 0-9 a-z A-Z and all keyboard symbols". I'm not sure if "all keyboard symbols" is clear enough to most people?


I don't think you need to overthink it too much, most users understand the concept of passwords these days.

I would suggest something simple like this can work:

A valid password can only contain letters, numbers and special characters.

I would suggest making "special characters" a hyperlink (as illustrated by the bold style above). This can either show a pop-up, or expand a panel, which lists all the valid characters.

This approach keeps the form simple and uncluttered and will satisfy the majority of your users, but it also allows for the "less knowledgeable" users to get the extra information they need with a simple click.

  • I found your answer a bit not inclusive. Does ideogram are included in your special characters? What makes them special? Why a kanji couldn't be an accepted character? I think that you are right: don't overthink it, just accept all the characters. They are simple "bits" at the end. 😊 – Geoffrey C. Jan 22 at 15:57
  • @GeoffreyC.: Special characters are whatever the OP decides meets their requirements, it isn't for me to decide which ones should be included. This question is about how best to present that information to the users. – musefan Feb 4 at 14:07
  • I think the real question is: should you really present that information to the users? It's already a technical information that a lot of people don't understand. I'm for a lesser cognitive load during this kind of process. My answer to this ux.stackexchange.com/questions/136395/… – Geoffrey C. Feb 4 at 16:00
  • @GeoffreyC.: Yeah, I think it's important to inform the user. They need to be aware of what is valid and what isn't. We can't have them repeatedly attempt passwords until they get a valid one. WRT cognitive load, this is why I suggest it is initially just a link that the user can click to expand if they need to know the exact characters that are valid. As I said, most users won't need the extra info, but some will, so it's good to make that available as and when it's needed. – musefan Feb 4 at 16:04
  • You didn't get my point. My point is that everything should be accepted. If everything is accepted, you don't need to inform the user anymore :) – Geoffrey C. Feb 4 at 16:57

I'm sorry if I don't answer easily, but that's my old habit of being a designer, I usually start with the 5 whys.

Why would you limit the user in using specific characters in the first place?

Security reason

More special characters don't make your password more secure, the longer of the password is more important than the type of character. For instance, for security and usability reasons, it's more effective to use a passphrase as password, than a complete to remember password with a lot of specific characters. (source)

Image from Dropbox illustrating password strength Image from Dropbox article.

Usability reason

A passphrase that makes real sense for the user will be easier to recall. Motivate the user to use a longer pass with a gauge to evaluate it strength. It will have a double positive effect:

  • it will be easier to recall
  • longer passphrase means less need to change it often

Also, when you need to read all the requirements to create a "good password" you add frustration and make the user lost their initial goal:

  • people are more likely to forget instantly the beginning of their password and hit the "I forgot my password"
  • complex password for computer to guess are also too complex for users to remember > "I forgot my password"

Then users look for a way to not having to recall the password, and if a "remember me" option is there, they will use it, making their account easier to reach.

English-centric solution / Inclusivity

Not allowing all the characters is oftentime limiting the range to "english characters" which most of the non-english speakers find totally egotistic. For a more inclusive way to think about that, just allow everything.

Alternative solution

The best way would be to advice your user by educating them:

  • Use a gauge to show the password strength. Plus: people love to play with it.
  • Add advices alongside user's typing the password.

An excellent implementation of that is Dropbox solution. I totally recommend the reading. You can test it in a technical aspect here: https://lowe.github.io/tryzxcvbn/ and it proposes suggestions while typing.

I hope I could help you I your case despite the way I answered 😊


"All keyboard symbols" could introduce additional confusion in some cases: not all keyboards are the same, some have characters which are not in your list, frequently used by speakers of other languages.

"special characters" with validation sounds like a good solution in most cases. The error message could also be improved to indicate which specific character is not allowed. This will be helpful when the user is pasting it in from password manager, instead of typing one character at a time.

  • 1
    Not convinced by the "special characters" since in typography no character is special. They all have a specific meaning. Also, that list of told "special characters" change from a website to another. Why not just accept all the characters at the end? – Geoffrey C. Jan 22 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.