I found in my application a particularly bad validation error message,

Password must be at least 8 characters long and are all ASCII characters

Ignoring the ambiguous grammar, this is meaningless to the average user, and is the kind of jargon that increases cognitive load needlessly.

How does one explain in plain English what subset of characters ASCII is?

2 Answers 2


Something like the below will be intelligible to most users.

You may only use the characters A to Z, 0 to 9, and simple punctuation in your password.

The key is to only show it when they try to add a non-ASCII character.

That way any user who tries to use a character in the ASCII set but not in that description will be fine, and won't even see that it is "disallowed".

But users who use something not supported have clear guidance on how to continue at the point where they are stuck.

Note: it's out of scope for this stack, but you really want to look towards allowing more complicated passwords for security purposes.

  • Totally agree with the note.
    – Rol
    Jun 9, 2016 at 15:58

"Your password must be a minimum of 8 characters long and may contain any standard alphanumeric character or the following symbols: ! # %"

(There may be symbols that are ASCII characters but that you may want to restrict people from using in their password to address things like cross-site-scripting vulnerability. Providing a list of green-lit symbols is the helpful thing to do.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.