I have just noticed that Google as well as some other sites trims the whitespaces in the password.

I can successfully sign into my google account even if I add extra spaces in the end of my password.

Is this behaviour intended or a bug?

I also tried some other sites, and I found out that many sites do such things.

I believe this is a very serious security issue, as some people may intentionally add spaces at the beginning or the end of the password to enhance the security.

  • 1
    On a related note, why does Windows think that Ctrl+Backspace is a valid character for a password? – oldmud0 Apr 2 '15 at 0:55
  • @oldmud0 really weird behaviour! – zccoding Apr 2 '15 at 7:25
  • 2
    I personally applaud them. I have been trying for years to figure out how to write a space character at the front/end of my password on the sticky note under my keyboard. Please don't ruin this for me. I'm calling Google as I type this comment and will tell them to not listen to this post. – MonkeyZeus Apr 2 '15 at 23:42
  • "I can successfully sign into my google account even if I add extra spaces in the end of my password". That's the reason for the trim: you already answered yourself. – Andrea Apr 3 '15 at 7:33
up vote 61 down vote accepted

Good observation.

In my experience this happens for a number of reasons, some intentional and some unintentional.

Intentional reasons to trim whitespace:

  • Users often cut and paste passwords (yes, use of Notepad as a password manager really happens) and the paste operation for some clients adds a whitespace.
  • Phrase (multi word) passwords are increasingly used by people to increase the length of passwords, and users sometimes add a space involuntarily out of habit.
  • Mobile keyboard often add spaces after words. While mobile browsers are supposed to recognize the password control (eg type=password) and avoid doing this for passwords, they do not always do this.

Unintentional reasons:

  • Many apps use standardized form handlers (eg Ajax handler) which trim whitespace for fields by default, and developers may fail or be too lazy to override the behavior for passwords.
  • Passwords are often white listed to prevent illegal or unrecognized characters, and the regex matching sometimes trims the whitespace by mistake.
  • etc.

So there is no great answer here because the reasons really vary a lot.

But one thing is for sure....the inconsistent enforcement and the lack of site disclosure around this makes for a pretty crappy UX experience for users who notice, or who try to use leading or trailing whitespace!

  • 2
    Hopefully the companies who do trim the spaces inform people during sign up (if they try to include a whitespace) that it is character they don't support. In which case it just benefits the UX for the reasons tohster mentioned e.g. copy and pasting or mobile keyboards – Chris Apr 1 '15 at 11:07
  • 14
    "Users often cut and paste passwords (yes, it really happens)" > well, how do you remember passwords for dozens/hundreds of servers ? You don't. You have a document with the passwords. And then you copy/paste these. And yes, you often get trailing spaces. – thomasb Apr 1 '15 at 14:00
  • 2
    @Falco any unexpected folding of a password (e.g. case-insensitive passwords for another somewhat common example) reduces the effective entropy and could influence the user's decision on choosing a password. – Random832 Apr 1 '15 at 15:58
  • 10
    @cosmo0 use a password manager, its much more secure – Tyrsius Apr 1 '15 at 16:03
  • 14
    @cosmo0 no, a dedicated password manager will not have that issue. – Tyrsius Apr 1 '15 at 16:14

This behavior should not pose any issue. The sites that trim passwords will trim them both on initial entry and on use, those that do not will not. If you use spaces in your password, and they are trimmed out, you won't even notice.

Using spaces in the password does not enhance security any more than using any other character instead of space. But knowing that a site trims passwords could enhance security: if someone is watching you type your password, thrown in some extra spaces to distort their observation without actually distorting your password.

  • 2
    and they are trimmed out, you won't even notice. -- ...until you forget the space, are granted access and go "wtf, that wasn't the right password". – aioobe Apr 2 '15 at 13:01
  • 1
    "if someone is watching you type your password, thrown in some extra spaces to distort their observation" At best, this is security through obscurity. One must assume that the attacker knows the rules for password hashing on the system if you also do. – Tyzoid Apr 2 '15 at 18:56
  • 2
    "thrown in some extra spaces to distort their observation" -- how does that work? If they observe and remember a sequence of key presses that successfully logs in, can't they later log in by repeating that sequence, regardless of whether some of the keypresses were insignificant? You might as well press the CTRL key a couple of times to "distort their observation". Chances are either they can watch you type or they can't, the space bar isn't going to blow their tiny mind ;-) – Steve Jessop Apr 3 '15 at 0:37
  • 1
    Kind of OT, but it could theoretically work if you add so many spaces that the thing becomes too long too remember: "__p____a__s_____s___W...oh I give up". No, it's implausible really. – Steve Bennett Apr 8 '15 at 1:21

The simple answer is that it is *assumed that the whitespace was unintentional." I agree fully that spaces are very useful for increasing the password's entropy BUT I think this is a very useful compromise as many people cut and paste passwords and would be frustrated if they were not able to gain access to their site.

Re the issue of password security there are too many things that web sites do wrong as far as security is concerned. The most egregious one is limiting the number of characters for a password. (Assuming the passwords are not stored in clear-text.)

The simplest way to defeat dictionary and brute force attacks is by increasing the number of characters in the password.

Even if the system doesn't allow special characters a 62 character set (lower case, UPPER CASE, 0-9) is, for all practicable purposes unbreakable with 16 characters.

1 Trillion attempts / sec (as per Snowden) times 3/4 of a billion seconds in a year. Is roughly 10^19

A 16 character password is roughly 10^30; which is, as far as I can tell, unbreakable.

  • 1
    There's more to it than just length, though. A password like passwordpassword is probably not unbreakable just because it's 16 characters long. – snailboat Apr 1 '15 at 23:35
  • True. I simplified it a bit. :-) You need to avoid dictionary attacks which can be remembered by passphrases. "This is my super secret message that only I know" becomes "thimsusemethonikn." (the first two letters of every word. First letter if there are two or less letters in the word). That should be a safe password. There's enough entropy and it cannot succumb to a dictionary attack. – Mayo Apr 2 '15 at 1:15
  • To add to your answer, I've always used xkcd.com/936 to explain entropy to people. All this lower case, upper case, l33t speak, numbers, etc. is a joke for security. All that matters is length. Over 21 characters (since hashes are 7 characters) and you are safe. – Code Maverick Apr 2 '15 at 15:08
  • 3
    People should stop thinking in terms of calculations per second and start thinking in terms of physical limits: we can't really know just how fast computers will become in the future and there are many things I encrypt today which 20 years from now I would still not want to be decrypted. If we take a 25-character ASCII (95 printable character) password we get about 10^49 combinations; if we consider just the energy to merely write each combination to be only 1eV, well below the theoretical minimum, it would take 10^28 J to crack, in other words, the KE of the Moon's orbit. Futureproof. – thepowerofnone Apr 2 '15 at 17:32
  • @thepowerofnone "The bad news is, in two and a half hours the moon will crash into the earth. The good news is, I got my Tumblr account back." – Sneftel Apr 2 '15 at 21:29

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.