Why the crazy password requirements? It a Q&A site, and I have to conform to arbitrarily chosen password complexity criteria.

With a 22 random lowercase characters (entropy 119 bits), the create account page asks me to:

Add upper case, numbers, or special characters.

Just adding uppercase characters to the mix does not satisfy the requirements. With 125 bits of entropy, It still asks me to:

Add numbers, or special characters.

Fortunately, doing either of these does satisfy the requirements. As long as there are enough unique characters. The password a1ᓕ♵Ŀꁏꂯ (with a1 replacing Unicode characters to satisfy the numbers and letters requirement, reducing the level of entropy from 112 to 88 bits) still causes the generator to insist that the password:

Must contain at least 1 more unique characters.

Sadly, the famous correct horse battery staple password doesn't fly, either:

Add upper case, or numbers.

I add entropy in my passwords in other ways than the Password1 (entropy approximately 0) mechanism suggested by these requirements, and prefer to use the Stack Exchange OpenID provider.

  • 5
    I added some examples because most people viewing this question will have created their profile a long time ago and forgotten about the requirements. Feel free to roll back or modify if you don't like my edits. Commented Oct 31, 2011 at 3:14
  • 9
    Obligatory XKCD reference. Commented Oct 31, 2011 at 3:16
  • 25
    Obligatory meta-XKCD reference. Commented Oct 31, 2011 at 3:20
  • 3
    For those currently reading, the obligatory XKCD reference is now in the question.
    Commented Oct 31, 2011 at 3:35
  • 2
    Thank you for reminding me why I use OpenID. Commented Oct 31, 2011 at 6:57
  • 17
    "Why the crazy password requirements? It a Q&A site" -- It's not just a Q&A site, it's an OpenId provider (which you know, since you mention it). Also: security.stackexchange.com/questions/3913/…, so we have an on-topic reference as well :)
    – balpha StaffMod
    Commented Oct 31, 2011 at 8:00
  • 4
    @balpha that's not the only reference we have: security.blogoverflow.com/2011/10/how-long-is-a-password-string
    – user142852
    Commented Oct 31, 2011 at 12:40
  • As posted in my answer to the duplicate question if you're creating a long-length string of arbitrary characters, what is the difficulty in adding upper-case or uniqueness? If users like you aren't truly inconvenienced (other than for the sake of academic discussions), and the alternatives are to have no restrictions at all or to have equally arbitrary yet different-than-the-current restrictions, what is the drawback to the current situation and how would a change improve it?
    – Farray
    Commented Feb 22, 2012 at 21:36
  • 2
    @Farray What about making a long-length string of only lower case letters? More secure than Password1 and easier to remember than the average random string. What about the fact that 8 unique characters is a significantly smaller search space than 8 arbitrary characters? It'll block aaaaaaaa, sure, but as noted Password1 still passes. The dumb will be dumb unless the requirements are so insane as to be impossible; making everyone jump through hoops in a failed attempt to mitigate reality is not something that makes sense to me.
    – user154510
    Commented Feb 22, 2012 at 22:11
  • @MatthewRead Your point about smaller search space is valid, but perhaps mitigated by the apparent lack of maximum length. I agree that the dumb will be dumb, but that doesn't mean they should be ignored. In this case I happen to think that the smart are minimally inconvenienced one direction, while the dumb are minimally inconvenienced the other direction. A good compromise...
    – Farray
    Commented Feb 22, 2012 at 22:43
  • If someone sums up some great reasons for why they should change the criteria, I'll award the bounty to them. None of the current answers really answers the question.
    – Emil
    Commented Mar 25, 2012 at 16:02
  • 2
    Ugh... I just found out about SE's excessively-complex password requirements because MyOpenID is down and I can't login to another SE site. I went to create an SE account and found that my PW requires 3 lowercase, three uppercase, three numbers, and three special characters??? That is beyond ridiculous. At the very least, how about any combination of casing, numbers, and special characters so long as at least two are present (ie, mix/match of upper/lower, lower/number, upper/special, etc)) Commented Jul 6, 2013 at 15:57
  • For people coming to this more recently, see meta.stackexchange.com/q/187759/160917 for a discussion of this requirement from a technical perspective. The short version: the password criteria are well-intentioned but ultimately I suspect they might be counter-productive.
    – D.W.
    Commented Sep 6, 2013 at 20:47

4 Answers 4


Kevin Montrose's concern is that ordinary users will be confused by an entropy meter. That does not justify blocking good passwords, which is what the current system does.

A simple way to satisfy both criteria:

  • Calculate entropy in the background. Any password with entropy over some threshold will get accepted.
  • Passwords with less entropy than that fall back to the system shown. For example, if someone gives a low-entropy password that contains only letters, it could suggest adding "upper case, numbers, or special characters". To avoid being user-hostile, passwords that meet all the constraints could be accepted (even if they have low entropy).

    You claim that you're using your password criteria to enforce security for OpenID accounts. That's fair—except the current system accepts qwerty1! as a password. Seriously? If you're going to "fall on the strict side" for security, you shouldn't be accepting passwords with 6.322 bits of entropy (according to zxcvbn).

There exist libraries to quickly estimate entropy, such as the one Dropbox uses.

  • 12
    Has anyone from SE actually produced a legitimate, sensible reason as to why they are absolutely not going to reconsider loosening up the password requirements? Commented Jul 6, 2013 at 22:23
  • To paraphrase: "We are sorry, this password does not meet our network's strengths standards."
    – badp
    Commented Apr 3, 2014 at 19:58
  • Some insight: maybe they're afraid that moderator accounts may get hacked with password123... there's a lot of data that shouldn't be available to anyone except mods. Commented Apr 4, 2014 at 1:28

I appreciate that there is no way that this policy is ever going to change based on what I have to say, but it is a good example of listening to your customers needs, and then ignoring them to go off and do something fun instead.

  1. Stack Exchange initially only allows login using openid.
  2. Lots of people don't like that. We just want to log into a Q&A site and ask a question. We don't want any connection between this site and our gmail account or our facebook account or whatever. Having a single password that if broken allows access to everything about their life doesn't seem more secure to us. It's not even clear whether Stack Exchange will now have access to their gmail or facebook account. Presumable not, but who knows? All we want is to give an email address and password and log into the site to ask a question.
  3. Stack Exchange says that the acquisition of new users is a very high priority. The openid thing is deterring users, so they fix it. Hooray, everybody is happy.
  4. Especially the developer who, instead of having to so some boring password authentication, gets to play with openid.
  5. But the password standard is needlessly zealous. We have an intuitive understanding of when it is important to have a really good password, and sorry but a Q&A site does not make the cut.
  6. But the password standard can't be lowered to something more appropriate for a Q&A site, because instead of doing the simple thing and allowing people to log on using an email address and password, Stack Exchange did the fun thing instead with openid.

Now I personally will cope with the password rules because I have seen the effectiveness of stackoverflow.com before, and I need a question answered for work. But I wonder, how many people who stumbled upon Stack Exchange gave up at that first barrier?

So if anybody from Stack Exchange is out there reading, maybe consider the following:

  1. Stack Exchange really wants new users.
  2. A simple password is sufficient for a Q&A site.
  3. The current password system is turning potential new users away at the door.
  4. You could fix it if you wanted to.
  • 5
    -1 for ranting based on paranoiac opinion and made-up stories, but pretending it's based on facts.
    – balpha StaffMod
    Commented Jun 14, 2012 at 6:09
  • 4
    Funny story. Particularly the bit where you imply your gmail account is a poor choice because it might get hacked, and then go on to express a desire for a weak password because it's just a Q&A site (and therefore presumably you don't care if it's hacked). But if I can be serious for a minute: the best way to protect your SE account is to use multiple, separate forms of authentication - that way if you lose access to one, you can still use the other (and even revoke the first).
    – Shog9
    Commented Jun 14, 2012 at 7:31

Stack Exchange username/password accounts are actually OpenIDs, not something tied to the Q&A portion of the network ( https://openid.stackexchange.com/ ).

Because these accounts aren't constrained in use (by design) we can't assume anything about the "importance" of the account, thus the rather stringent password constraints.

What the password contraints are meant to do is act as a "normal person"-readable proxy for entropy.

Directly exposing entropy measurements to a registering user would be absurdly user hostile, and a simple yes/no indicator just begs the question "why isn't my password acceptable?" (you can't just say "not enough bits!").

In short, while you and I (and a non-trivial number of the people reading this, I'd wager) can reason about Shannon entropy the typical end user cannot. The character class stuff is a reasonable approximation that has the benefit of being explainable, and we fall on the more strict side because security is involved.

So no, we won't be relaxing the openid.stackexchange.com password requirements.

  • 21
    I'm sorry, but .. what? These arguments are not convincing me at all.
    – Emil
    Commented Mar 19, 2012 at 21:29
  • 17
    If the security of these accounts were actually a concern you'd improve things far more by not leaving so many them many of them unknowing logged in than by implementing ridiculous requirements like this.
    – Jeremy
    Commented Jun 5, 2012 at 5:13
  • 3
    Lots of passwords have "very weak, weak, acceptable, strong, very strong" I fail to see how anyone would find that confusing, expecially with a hint; make the password contain more words, be longer, or include more special characters to make the password stronger" Commented Jul 4, 2013 at 8:26
  • 4
    And the whole point is that passwords created with these requirements arent strong, as xkcd says "We've trained a generation of internet users to pick passwords that are hard for people to remember but easy for computers to guess" Commented Jul 4, 2013 at 8:30
  • 5
    "thus the rather stringent password constraints" These are not stringent password constraints. They are nonsensical password constraints that reduce the security of the account.
    – endolith
    Commented Jul 4, 2013 at 16:13
  • You could also say "days to crack." Or is that still too complicated for users to understand? I suppose we can't expect users to know what passwords do at all.
    – djechlin
    Commented Mar 3, 2014 at 15:40
  • While opposing this decision for the reasons others stated, if the decision stands, I suggest: (1) in the pop-ups, put "unique" in bold (it's unambiguous but it's not obvious); (2) fix the bug that causes the pop-up to sometimes advise a change, and then advise the SAME change when the advice is followed (see my answer for an example).
    – WGroleau
    Commented Apr 3, 2014 at 17:19
  • So... how is "why isn't my password acceptable?" different from "how does my post not meet the network's quality standards?" :)
    – badp
    Commented Apr 3, 2014 at 20:00
  • I didn't rate/answer any questions on SO for 1 month despite visiting the site on a daily basis because a) I couldn't remember my complex SO password (just like every time I need to logon) and b) couldn't login to gmail to reset it due to geoip missmatch. Complex passwords should be optional and it should be a user's decision to judge about password strength, not the website's.
    – beta
    Commented Jan 9, 2015 at 12:45
  • It looks like you've changed this at some point! :D I just registered a new account and it only asked me for one letter and one number. Thanks!
    – Jeremy
    Commented Dec 18, 2015 at 9:06

Make a two-column table: two-char language codes against a very common word in that language. Randomly pick a row from that table. Ask Google or other search engine "Show me pages in language xxx containing word yyy" Randomly pick one of the the fifth through zzz hits. Randomly pick a word from that page. Repeat. Stick the two words together. Write them on a post-it Stick that on the bottom of your keyboard. Cuss and swear because all the sites only accept ASCII characters.

My problem is that I followed the usual asinine rules exemplified in XKCD for nine characters, and SE said I need one more character. So I invented a new one with ten characters and SE said I need one more character.

UPDATE: One more unique character, i.e., one not yet used. So 5tack-Exch@nge! would probably work :-)

By the way, “gizmo didn't eat chicken after midnight” was accepted. I didn’t try to log in with it, though.

Next experiment: Pasted in two Chinese words separated by a semi-colon. The request was to add one capital letter or digit. Putting a '2' on the end still got the same request.

  • Downvoted why? Won't work? Insecure? Didn't like the sarcasm?
    – WGroleau
    Commented Mar 3, 2014 at 15:51
  • 1
    I'm not a downvoters but i'm not really sure what you're saying here. If it was a question I would vote to close under "unclear" Commented Mar 3, 2014 at 15:57
  • 1
    Your post didn't really add any information.
    – djechlin
    Commented Mar 3, 2014 at 16:16
  • The information it added is (1) a description of a way the rules can be misinterpreted; (2) two things that are both easy to remember and fairly secure, yet aren't rejected by the rules so many of us hate; and (3) something that complied with the stated rules and yet was rejected. My apologies if the sarcastic intro obscured that.
    – WGroleau
    Commented Mar 7, 2014 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .