I found in my application a particularly bad validation error message,
Password must be at least 8 characters long and are all ASCII characters
Ignoring the ambiguous grammar, this is meaningless to the average user, and is the kind of jargon that increases cognitive load needlessly.
How does one explain in plain English what subset of characters ASCII is?
Something like the below will be intelligible to most users.
You may only use the characters A to Z, 0 to 9, and simple punctuation in your password.
The key is to only show it when they try to add a non-ASCII character.
That way any user who tries to use a character in the ASCII set but not in that description will be fine, and won't even see that it is "disallowed".
But users who use something not supported have clear guidance on how to continue at the point where they are stuck.
Note: it's out of scope for this stack, but you really want to look towards allowing more complicated passwords for security purposes.
"Your password must be a minimum of 8 characters long and may contain any standard alphanumeric character or the following symbols: ! # %"
(There may be symbols that are ASCII characters but that you may want to restrict people from using in their password to address things like cross-site-scripting vulnerability. Providing a list of green-lit symbols is the helpful thing to do.)
