A compilation of websites with dumb password rules

>Restrict the inclusion of a % character.

That's awfully specific that begs the question why it exists.

IIRC a website for a train company in Japan requires exactly 8 letters as password even now. I can’t remember which though.

This is what happens when compliance rules force sites to have specific policies. Especially when you have more than one set of rule combined.

With that said, a lot of these seem pretty reasonable. The one that I really don't get that keeps appearing is max length though. I get that they may not want to allow you to have a 10MB password but I think a reasonable max like 500 characters would be better. A max length of 8 makes me think they are storing the unhashed password in a VARCHAR.

Also, from a UX perspective some of these rules may be best to only tell the user about if they actually trigger it. Like "most not contain username" is uncommon enough they can probably only show it if it actually happens. Same with "cannot reuse last 4"

Because someone couldn't be bothered to parameterise their queries, and, as such, is explicitly rejecting characters which are used by some underlying language they're working with (or Windows environment variables, I suppose).

Same reason you'll see dollar signs and quotes often disallowed.

ME Bank is the best:

- Must be all numerals.

- Be 7 to 20 digits.

- Cannot have the same number three times in a row.

- Cannot have four ascending or descending numbers.

- Cannot have the same number appear more than five times.

- Cannot have pairs next to each other if the second pair is one number higher.

- Cannot be the same as 8 previous ones.

It would be fun to work out mathematically how much they're limiting the password space with these rules. I'm also not sure what "Cannot have pairs next to each other if the second pair is one number higher"; is that referring to consecutive pairs of numbers, or pairs of consecutive numbers, e.g. 7788 vs 7889.