Basically all of these constraints are bad practice, though. It’s obviously better to have a long, complex password, and not to reuse passwords between sites, but if you make shit impossible for people to remember they’re going to write it down, and a lot of people don’t use password managers (or use shared devices where they aren’t possible).
Length limits (that aren’t like 1000 characters) are unconditionally terrible practice. It means your password is probably plain text, because hashes don’t really care or take meaningfully longer based on the length of the input.
A string of (random) words is a perfectly fine password. There’s an xkcd I’m too lazy to get demonstrating it, but it genuinely does add enough randomness to break brute force.
A string of (random) words is a perfectly fine password. There’s an xkcd I’m too lazy to get demonstrating it, but it genuinely does add enough randomness to break brute force.
Knowing that it’s already in use is.
Basically all of these constraints are bad practice, though. It’s obviously better to have a long, complex password, and not to reuse passwords between sites, but if you make shit impossible for people to remember they’re going to write it down, and a lot of people don’t use password managers (or use shared devices where they aren’t possible).
Length limits (that aren’t like 1000 characters) are unconditionally terrible practice. It means your password is probably plain text, because hashes don’t really care or take meaningfully longer based on the length of the input.
A string of (random) words is a perfectly fine password. There’s an xkcd I’m too lazy to get demonstrating it, but it genuinely does add enough randomness to break brute force.
Here’s the xkcd.