Password Rules Are Bullshit

I totally agree that arbitrary password rules are not a good thing, they frustrate users to no end, and can make things less secure.

I really liked the zxcvbn library from Dropbox, as it allows you to catch those really egregiously bad passwords before it’s too late, but is much smarter than any list of arbitrary rules could be. I actually wrote a similar library (nbvcxz) for my company which implements all of the functionality of zxcvbn (and extends it as well) so I could use it on the server side.

1 Like