Products · Pattern or everyday thing
Password rules
Raised as a usability problem by 33 people on Hacker News over 18 years (2008–2025), in 29 threads.
No issue was raised by at least 3 people in 3 threads this year.
Every issue, all time, most people first
Forced password changes make users forget current passwordsUnreviewed
20082026- Long random passwords are unmemorizable and untypable, pushing users toward weak ones2025-03-31
- Forced special characters make passwords hard to remember, so people write them down2024-12-06
- Forced password strings are impossible to remember, which makes logging in hostile2023-07-22
Restricted special characters are hard to type on some keyboard layoutsUnreviewed
20082026- Users may accidentally enter hard-to-type characters and then be unable to log in on other devices2019-09-06
- Required capitals and special characters force keyboard switching on mobile, making sign-up painful2017-03-10
- Restricted special characters are hard to type on some keyboard layouts, causing people to get passwords wrong2016-12-05
Unreviewed issues were grouped by machine: Claude Haiku labelled each comment as a usability complaint, named what it's about and summed up the problem in a line, and a small model grouped similar problems. Nobody has checked them by hand. Expect mistakes.
The newest 32 complaints
- Long random passwords are unmemorizable and untypable, pushing users toward weak ones2025-03-31
- Forced special characters make passwords hard to remember, so people write them down2024-12-06
- Rules flag violations that don't exist and reveal requirements only piecemeal2024-03-08
- Forced password strings are impossible to remember, which makes logging in hostile2023-07-22
- Onerous password rules like expiry and character counts are imposed by customers and risk managers2022-12-23
- Strict password rules add friction for new and existing users without real security benefit2022-11-24
- Contradictory min and max password length rules; errors give no hint, forcing repeated retries2022-08-04
- Passphrases of thirty-plus letters and spaces get rejected by sites2022-03-13
- Password rules keep changing and are hard to meet, forcing people into insecure workarounds2021-11-16
- Users forget complex password rules and get locked out of accounts2021-11-16
- Strength rules force users into algorithm-generated passwords they can't remember2021-05-09
- Complexity rules make passwords harder to remember and type, causing errors2019-12-13
- Users may accidentally enter hard-to-type characters and then be unable to log in on other devices2019-09-06
- Forced password changes and rules make users unable to remember current passwords, so they resort to forgot-password flows2018-01-02
- Sites demand complex character mixes and ban spaces, colons, commas, and quotes2017-11-26
- Forced 30-day password changes and reuse bans push users into workarounds like appending dates2017-10-25
- Requires a symbol but rejects common ones without saying which are banned until submission2017-08-10
- Users can't predict which passwords password crackers will reject as weak2017-07-26
- Login fails silently when password breaks site rules, with no explanation2017-03-11
- Forced complex password rules make people forget passwords and repeatedly reset them2017-03-10
- Required capitals and special characters force keyboard switching on mobile, making sign-up painful2017-03-10
- Password requirements are bad UX, and crypto keys are even harder to use2017-03-10
- Restricted special characters are hard to type on some keyboard layouts, causing people to get passwords wrong2016-12-05
- Users can't type disallowed characters like umlauts or pipe symbols, and can't find the pipe on Mac keyboards2016-09-08
- Restrictive password rules make it hard to keep track of and manage passwords2016-05-19
- Complex password rules make passwords hard to remember, so users write them down or reset them2015-04-09
- Strict password rules make users' usual passwords fail and force repeated recovery2014-12-01
- Sites have differing password rules and force frequent changes, pushing users to store passwords insecurely2014-09-02
- Forced password changes every few months push users into weaker passwords they must reuse2012-08-21
- Forced password formats are hard to remember and make people use arbitrary patterns2012-06-04
- Users must memorize long random passwords, a poor user experience2011-02-21
- Forced letter-and-number rules with minimum length make short memorable passwords impossible2008-07-31