Ask HN: Why do websites disallow spaces in passwords?

There is no good reason. Spaces are no special characters in passwords. They should simply be allowed.

I think it's good practice to trim leading/trailing whitespace from all inbound data. Google docs for one usually appends a newline to data kept in cells. Not so good if you're keeping passwords in a spreadsheet.

That doesn't address spaces IN passwords, but I know I've never written a script to block them. If I had to guess I would say it depends on individual frameworks or the behavior of individual languages. E.g. python has a decent strip() function, javascript doesn't. If you need to trim whitespace in javascript you need to write a regex. It would be easier to test/remove all whitespace instead of trailing/leading whitespace. Maybe that's a clue.

Probably because of this. A bunch of coders get into a meeting with a bunch of managers, passwords and security come up, it's a bike shed issue, so everyone throws their two cents in.

Some guy saw something break once because a password with a space was passed on exec(). Some guy knows that crypt() only uses the first 13 characters. Some guy knows that passwords with less than 5 characters are extremely weak. Some guy knows that \ also breaks when passed to exec() or sh, etc. This goes on ad nauseum for about an hour, a bunch of people are bored and just want to get out of the meeting so they propose the following which everyone can agree on.

Spec: Alphanumeric passwords with a minimum of 5 characters and a maximum of 13.

Result: m/^[A-Z,0-9,a-z]{5,13}$/

I think it might be so that you can type in your password on any keyboard. Some special characters may be missing on some keyboards, or they may need to be typed in differently, depending on your locale.

"It's actually harder to disallow spaces"

Traditionally, when deciding what password characters to allow/disallow, everyone thinks in terms of what to allow, not what to disallow.

For example, a system that only allows alphanumeric characters in passwords (i.e. no special characters) would use less code to specify with regex that only a-z,A-Z,0-9 should be allowed, rather than specifying the many characters to be blocked (and even when more complicated options were allowed, code generally still specifies allowed characters, rather than disallowed characters).

Therefore I would suggest that websites disallowing spaces in passwords is in fact just that they didn't see fit to allow them, not that they went out of their way not to.