Are spaces valid components of a password? [closed]

Question

Is space a valid component of a password or not? I am trying to save recent 10 passwords in one string in database and need to find a good delimiter for them. I think space maybe a good candidate. What do you think?

Answer 1

It depends on your password policy. I know quite some sites/systems where the space is a valid character for a password. To be on the safe side you could check for spaces within the password and escape those.

Oh, and as a short update: Try to repair the database design. As you have a 1:n relationship, you should save each password separately and connect every entry to the according user.

Answer 2

You can't rely on space, as it is a valid password character on most systems, especially now that pass-phrases are the new passwords.

Depending upon what/how you are doing this, you might be able to use a char with ASCII 0x00, another character not normally found on a keyboard or what about unicode?

Personally, I wouldn't attempt to concatenate them into a single string, I'd probably store a entry for each password.

Answer 3

Spaces are normally valid. I'd be wary of any delimiter, as it's a form of security through obscurity that someone won't crack it or accidentally stumble on it in the future and you'll have to figure out the bug.

I'd use a separate entry for each one.

You don't mention what application this is...if you're making the application, you could try doing something to enforce your own policy that would scrub out and sanitize the entry, or you would more sensibly hash the password (you generally don't want actual passwords saved) and the hash wouldn't have the password in it. Then I suppose you could use whatever delimiter you want as long as it isn't part of the hash namespace of characters.