Ask HN: Why do websites disallow spaces in passwords?

There is no good reason. Spaces are no special characters in passwords. They should simply be allowed.

I think it's good practice to trim leading/trailing whitespace from all inbound data. Google docs for one usually appends a newline to data kept in cells. Not so good if you're keeping passwords in a spreadsheet.

That doesn't address spaces IN passwords, but I know I've never written a script to block them. If I had to guess I would say it depends on individual frameworks or the behavior of individual languages. E.g. python has a decent strip() function, javascript doesn't. If you need to trim whitespace in javascript you need to write a regex. It would be easier to test/remove all whitespace instead of trailing/leading whitespace. Maybe that's a clue.

Probably because of this. A bunch of coders get into a meeting with a bunch of managers, passwords and security come up, it's a bike shed issue, so everyone throws their two cents in.

Some guy saw something break once because a password with a space was passed on exec(). Some guy knows that crypt() only uses the first 13 characters. Some guy knows that passwords with less than 5 characters are extremely weak. Some guy knows that \ also breaks when passed to exec() or sh, etc. This goes on ad nauseum for about an hour, a bunch of people are bored and just want to get out of the meeting so they propose the following which everyone can agree on.

Spec: Alphanumeric passwords with a minimum of 5 characters and a maximum of 13.

Result: m/^[A-Z,0-9,a-z]{5,13}$/

If there is a rationale I'll bet 99.9% of people don't know what it is. So, the answer is easy: because that's how everyone else does it.

Leading and trailing spaces because more than one username would look the same on the page eg. "user" and "user " which would confuse others when signing comments etc.

"It's actually harder to disallow spaces"

Traditionally, when deciding what password characters to allow/disallow, everyone thinks in terms of what to allow, not what to disallow.

For example, a system that only allows alphanumeric characters in passwords (i.e. no special characters) would use less code to specify with regex that only a-z,A-Z,0-9 should be allowed, rather than specifying the many characters to be blocked (and even when more complicated options were allowed, code generally still specifies allowed characters, rather than disallowed characters).

Therefore I would suggest that websites disallowing spaces in passwords is in fact just that they didn't see fit to allow them, not that they went out of their way not to.

Every site that I have developed has allowed a space.

To me, The most important reason to disallow spaces is being consistent with most of the web. Also, I think password with spaces are more likely to be forgotten. Its also easy to introduce spaces accidentally, and depending on the font parameters it might not be easily distinguishable too.

White space in passwords might be confusing if the system offers to email a user his own password. (Whether this should be done or not is another argument and is heavily dependent on the nature of the application.)

How much entropy does white space add to a password? Where are most people putting spaces in passwords? Are they using passphrases (in which case the position of spaces can be guessed and thus have low entropy)?

Given that I can think of a potential downside and possibly no gain in security, I can understand why some may default to not allowing it.

NO reason. After all the only thing going into the database ought to be base64 encoded hash. So why not allow anything? No need for a max length, by the same token.