Contents
What should be the maximum password length?
Maximum password length should not be set too low, as it will prevent users from creating passphrases. Typical maximum length is 128 characters. Passphrases shorter than 20 characters are usually considered weak if they only consist of lower case Latin characters.
What symbols can you use in passwords?
Under normal circumstances, a valid user ID and password can contain the following characters:
- Lowercase characters {a-z}
- Uppercase characters {A-Z}
- Numbers {0-9}
- Exclamation point {!}
- Open parenthesis {(}
- Close parenthesis {)}
- Dash {-}; this character is not supported as the first character in the user ID or password.
Is there a maximum length of 72 bytes for bcrypt?
BCrypt is limited to 72 bytes. The original paper also mentions the use of a null terminator. This means you would generally limited to: But the BCrypt 2a revision specifies the use of UTF-8 encoding (while the original whitepaper refers to ASCII). When using UTF-8, one character doesn’t mean one byte, e.g.:
How many characters do you need to encrypt a password?
The same advantage you get with encrypting (two-way) the hash. This way you do not need to reserve characters for the pepper, you can use all 72 characters from the password. In contrast to the pepper, the server side key can be exchanged whenever this is necessary.
Where does the 72 byte limit come from?
The 72-byte limit comes from the Blowfish P-Box size, which is 18 DWORDs (18 * 4 bytes = 72 bytes). From the original bcrypt whitepaper: Blowfish is a 64-bit block cipher, structured as a 16-round Feistel network [14].
How many characters are in an 8 Char password?
Every time you add a character to your password, you are exponentially increasing the difficulty it takes to crack via brute force. For example, an 8-char password has a keyspace of 95^8 combinations, while a 20-char password has a keyspace of 95^20 combinations.