Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have to write down these passwords because they can't remember them ?

To clarify: what I'm thinking about here is where users may have their own preferred (and memorised) set of passwords, but get forced by sites to start making them longer; or adding a number, or sites which just refuse to accept the password unless the site itself deems it strong enough ( hello Google ). So users then have to think of other passwords that fit these particular criteria - which being non standard ones they are then more likely to write down.

So I guess the question is what do users actually do when confronted with a site which tries to force them to use passwords with particular formatting.

  • The article is related to your question. Consider the idea: "You don’t need to remember 100 passwords if you have 1 rule set for generating them" (from the article) – Alexey Kolchenko Jul 2 '14 at 12:53
  • 1
    Please also look at similar questions here on ux, you will get some other relevant info :-) – Toni Leigh Jul 2 '14 at 19:17

This xkcd comic illustrates quite nicely that the only thing you should worry about is the length of the password:

enter image description here

This quote brings it to the point:

Through 20 years of effort, we’ve successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

You should therefore take special care that passwords aren't restricted in length (I've come across quite a few websites where the maximum length was 8 characters!).

Forcing users to do anything is rarely a good idea. It might be better to allow all passwords, but display a "Password strength" value as direct feedback after they enter the password. You could calculate this strength based on length and/or special characters. The value could be represented by a colour, e.g. red for weak, orange for strong and green for very strong.

Personally, I don't like it when websites force me to choose a password that consists of various components (numbers, different cases, special characters). Most of the time these are the exact websites that receive a "Password reset request" the next time I visit them.

  • I go with this bit as the question answer "Forcing users to do anything is rarely a good idea. It might be better to allow all passwords, but display a "Password strength" value as direct feedback after they enter the password" – PhillipW Jul 4 '14 at 10:27
  • 1
    While this answer and the answer from Code Maverick are both great, there is one thing to note: When a password is 'cracked' it's generally not just brute forced. The biggest danger is from a DB leak, in this case there are several techniques undesirables use to get to your password, many of which rely not on your password strength but the strength of the sites hashing/salting/encryption. Some crackers can reveal 80%+ of the passwords on the entire database in just a few hours using lists and filters which include common words, prefixes, substitutions, numbers etc. – bendataclear Jul 7 '14 at 15:04
  • That's of course true. The 80%+ you said are on unsalted passwords I suppose? Hashing without salting makes it a lot easier for crackers with a database dump. However how to store your passwords and protect them against crackers is a bit out of the scope of this question :) – msp Jul 8 '14 at 8:15
  • Beware that "correcthorsebattery" is quite easily brute forcible for a computer. Because computers do not have to guess one character at a time they can use a dictionary attack. While it looks long "correcthorsebattery" becomes equivalent to 28 bit entropy as those are common words that computer will start the dictionary attack with. This password checker cygnius.net/snippets/passtest.html is one of few that models a dictionary attack. By comparison "correcthorseba3ttery" will take centuries to crack – Jason A. Nov 27 '14 at 11:22
  • While your point concerning dictionary attacks is valid, "correcthorsebatterystaple" would need over 60 years to crack (using the link you've mentioned). Before adding numbers instead of letters, the easier protection would be to begin each of the four words with a capital letter. This way it'll also take centuries but would still be easy to remember – msp Nov 27 '14 at 12:09

If it's not a site I care about, I leave.

If not, and I have to enter a complex password instead of a more secure password, one that's based purely on length, I use KeyPass:

enter image description here

Just for information's sake, https://howsecureismypassword.net/ is the place to go to understand why

Length > Complexity


Here is how long it would take to crack 00000000000000000000:

enter image description here


Here is how long it would take to crack A1b2c#d$:

enter image description here

  • 1
    Upvote based on example password crack times and link to password strength test site. Worth reminding people: Never use an existing password on password test sites. – Bernhard Hofmann Jul 3 '14 at 10:18

Rather than Showing them Password Strength.

Show them in this way.

For low password strength-----"Anyone can steal and guess your password"

For medium password strength----"Brilliant people like James bond can guess and steal it easily".

For Strong password ----- "Even god can't guess or steal .Good job"...Something like that :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.