The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 2,364 other followers

There are still sites limiting password lengt to low values like 20 or 15. Don’t!

Posted by jpluimers on 2019/08/26

There are still sites limiting password lengt to low values like 20 or 15. Don’t!

The why at [WayBackImplement Proper Password Strength Controls: Password Length has been in place since October 2012, since when cracking passwords has become way faster, so risk at length 20 back then is now a risk at something like length 40.

Password Length

Longer passwords provide a greater combination of characters and consequently make it more difficult for an attacker to guess.

  • Minimum length of the passwords should be enforced by the application.
    • Passwords shorter than 10 characters are considered to be weak (NIST SP800-132).

While minimum length enforcement may cause problems with memorizing passwords among some users, applications should encourage them to set passphrases (sentences or combination of words) that can be much longer than typical passwords and yet much easier to remember.

  • Maximum password length should not be set too low, as it will prevent users from creating passphrases. Typical maximum length is 128 characters.
    • Passphrases shorter than 20 characters are usually considered weak if they only consist of lower case Latin characters.




Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: