6

What is current practice when it comes to localization of passwords? I know many systems, even where Latin/romanised text is not used, do not recognize/accept two-bit/unicode passwords. My instinct is to make unicode characters available for passwords, but am not sure if there is sufficient server support for such a requirement.

1
  • 5
    Any server should allow Unicode input. If it doesn't, it's broken. And passwords are stored as salted hashes, which usually means some subset of ASCII (often hex strings). So it shouldn't really be a problem. Disallowing strong passwords is bad.
    – TRiG
    Dec 12, 2012 at 20:31

2 Answers 2

3

Unicode is a computing industry standard for the consistent encoding, representation and handling of text expressed in most of the world's writing systems.

Quote from Wikipedia page on Unicode.

That says it all, doesn't it?

1

You should let people use whatever is natural to them for input, and that means accepting Unicode. If someone is Russian, forcing them to use ASCII characters is a poor UX.

If they enter their password in a particular character set, it's their responsibility to make sure that they are typing in that character set when they enter it again later. I can't see a lot of people complaining about this, as for people that deal with multiple character sets, it's normal to deal with this. However I can see a lot of people being frustrated that you are forcing them to use a character set that they either don't have on their keyboards, or simply don't know.

The final reason is that it is better security if people are allowed to use Unicode characters in their password.

2
  • Then the problem becomes one of evaluating the password's complexity, as many security standards originating in anglophone countries are written assuming what is now called the Basic Latin block. It may require that, for instance a password contain one Basic Latin uppercase letter, one Basic Latin lowercase letter, one Basic Latin digit, and one Basic Latin punctuation mark. May 19, 2016 at 12:34
  • @DamianYerrick That isn't really a UX issue, it's a security policy issue. I have yet to see a situation where trying to enforce a given level of password complexity ends up with better security. Usually it results in someone reusing a password they already know, or writing the password down.
    – JohnGB
    May 21, 2016 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.