Sensible usecase for restricting special characters in passwords? Please See Why Not Allow Special Characters In a Password on Security.


Several websites I've come across limit the allowed special characters for a password. My thought was, it should all be hashed anyway so why does it matter?

Is there an actual security reason to restrict this?

Example error:

The password needs to be at least 4 characters.
Valid characters are: letters, numbers and the following symbols: #$%&amp;!?@.
Summary of comments, not to take credit.

Answer so far is: cryptographically no. But it's practical for usability.


Restricting control characters is useful for different interfaces/input methods.
Restricting non-ASCII characters is useful for avoiding bugs with different encodings.
Restricting characters that are not on every keyboard adds to the user-friendly experience (preventing the user from locking themselves out on a different device).
Restricting characters that are in different locations on different keyboards prevents 'habit-mistakes' on different keyboards.
When a password is easier to remember it's less likely to be written down (in theory) see: XKCD #936: Short complex password, or long dictionary passphrase?