# Password Rules Are Bullshit

**URL:** <https://discourse.codinghorror.com/t/password-rules-are-bullshit/5033>\
**Category:** blog\
**Created:** [March 10, 2017, 11:20am UTC](https://discourse.codinghorror.com/t/password-rules-are-bullshit/5033 "2017-03-10T11:20:05Z")\
**Posts on this page:** 1\
**Showing post:** 23

<div class="post-metadata">

**Author:** ![Tostino](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/t/54ee81/32.png) [@Tostino](https://discourse.codinghorror.com/u/Tostino)\
**Post date:** [March 10, 2017, 2:30pm UTC](https://discourse.codinghorror.com/t/password-rules-are-bullshit/5033/23 "2017-03-10T14:30:48Z")

</div>

I totally agree that arbitrary password rules are not a good thing, they frustrate users to no end, and _can_ make things less secure.

I really liked the zxcvbn library from Dropbox, as it allows you to catch those really egregiously bad passwords before it’s too late, but is much smarter than any list of arbitrary rules could be. I actually wrote a [similar library (nbvcxz)](https://github.com/GoSimpleLLC/nbvcxz) for my company which implements all of the functionality of zxcvbn (and extends it as well) so I could use it on the server side.

---

_[View the full topic](https://discourse.codinghorror.com/t/password-rules-are-bullshit/5033)._