Should whitespace characters be allowed in a password?

Question

I've tried different sites/products and this seems to be split fairly evenly. Windows 7 and Gmail allow you to insert spaces in your password. Hotmail and Twitter do not.

While allowing spaces in a password increases the complexity of a password, it seems like many sites/programs do not allow them. Is there a good reason to allow/disallow spaces?

Solution

This SuperUser question might be relevant.

I think that your observation is accurate: many web-based systems accept only alphanumerics and a subset of symbolic characters (say, 0-9A-Za-z/_-!), but I think that this is simply historical convention. It may also be that programmers are used to the <space> character delimiting fields, rather than being found inside them.

There's also the issue of visibility: if you allow multiple consecutive spaces in a password, can the user easily count them? Might a system even collapse them into one (as unaided HTML would)? Can even a single space character be easily and quickly identified?

However, plenty of other types of systems do allow spaces in passwords. I'd probably still stray from them simply to help prevent user confusion (if people are indeed used to spaces in passwords being invalid, a password with a space in may be confusing to many), but there doesn't seem to be any technical reason not to allow them.

Comments

[Lightness Races in Orbit]

I'd dispute "practically unbreakable". 20 characters is ~160 bits (normally), and with a subset of characters allowed it contains less bits of information than that. That's not so much for a supercomputer to break in a wee while. It really depends on the use case, I guess.

[Rory Alsop]

20 chars is still a challenge for a supercomputer. It all depends how short the "wee while" is in real terms!

[Rory Alsop]

Improves the strength, but may break applications - white space is often used to delimit parameters.

[Manfred Moser]

I was talking about practically in terms of money. If you have a super computer to break a password and can run it for a few hours it better be a really important password..

[Lightness Races in Orbit]

The strength isn't entirely relevant to the question of whether you should allow them.

[Sámal Rasmussen]

Both space and tab are visible characters. Also if you use a password manager, as you should, then you would just copy-paste the password, and then anything goes. Any character is as good as any other.