# Min Password Length vs Block Common Passwords
**URL:** https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207
**Category:** Feature
**Created:** [2 במרץ, 2017, 4:50am UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207 "2017-03-02T04:50:32Z")
**Posts on this page:** 10
**Page:** 2
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [14 במרץ, 2017, 9:47pm UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/21 "2017-03-14T21:47:44Z")
My bet there is that the client-side validation is counting octets, whereas the server, being Unicode-aware, is counting characters, and coming up with a different result.
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [14 במרץ, 2017, 10:35pm UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/22 "2017-03-14T22:35:46Z")
Characters in that codeblock (and indeed all of U+1xxxx) are four-octets long in UTF-8. I don’t know what it’s counting, but Unicode 7/Unicode 8 issues (like amphora) could be in play.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [14 במרץ, 2017, 11:21pm UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/23 "2017-03-14T23:21:56Z")
Taking the string " 🙂 " as an example, javascript says
```plaintext
"😀".length = 2
```
and Ruby says
```plaintext
"😀".length = 1
```
* * *
Which is the correct implementation here? @codinghorror's blog post says:
> [@](#):
>
> Enforce a minimum Unicode password length
because it’s nice and simple for users. So 🙂 is one character. That sounds reasonable to me.
However… the blog also says
> [@](#):
>
> If you paste the above four Unicode emojis into your favorite login dialog (go ahead – try it), to discover that it … isn’t in fact four characters.
This is indeed true of the Discourse password fields - one emoji = 2 characters. So if it’s showing as 2 characters in the password field, surely that should count as 2 characters in a password 😖
* * *
On a related note, it is currently very difficult to type emojis directly into html password inputs - you can only copy/paste them in. This is the case on Chrome on mac (using system emoji window), and also Safari on iOS (the emoji button doesn’t even show up with the password field focused). So, as much as I try, I can’t use ✅ 🐎 🔋 📎 as my password on Discourse (without cheating with copy/paste).
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [14 במרץ, 2017, 11:42pm UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/24 "2017-03-14T23:42:50Z")
`😀` is four octets in UTF-8: [Base64 visualizer](http://kevinlitchfield.com/base64-visualizer/?string=%F0%9F%98%80)
I have no idea why Javascript gets that count. (UTF-16?) But `😀` does show as `⏺⏺` in the password field of Discourse (for me).
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [14 במרץ, 2017, 11:50pm UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/25 "2017-03-14T23:50:49Z")
> [@elijah](#):
>
> UTF-16?
It would appear so (from [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/length))
> [@](#):
>
> This property returns the number of code units in the string. UTF-16, the string format used by JavaScript, uses a single 16-bit code unit to represent the most common characters, but needs to use two code units for less commonly-used characters, so it’s possible for the value returned by length to not match the actual number of characters in the string.
---
### Author:  [@fedup](https://meta.discourse.org/u/fedup)
#### Post date: [22 באפריל, 2017, 4:13pm UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/26 "2017-04-22T16:13:49Z")
A sentence with spaces - could be the best personal password choice
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [22 באפריל, 2017, 7:16pm UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/27 "2017-04-22T19:16:00Z")
I’m not sure a space would work. It’s a control character and there might be some filters somewhere that wouldn’t like it.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [22 באפריל, 2017, 8:45pm UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/28 "2017-04-22T20:45:29Z")
> [@Mittineague](#):
>
> I’m not sure a space would work
A space is absolutely fine, it’s just another character as far as a password is concerned. Try it here on meta - it works.
---
### Author:  [@Alt-Elijah](https://meta.discourse.org/u/Alt-Elijah)
#### Post date: [6 באוגוסט, 2020, 12:06am UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/29 "2020-08-06T00:06:21Z")
> [@Alt-Elijah](#):
>
> I found that the password change box gives me a green “okay” after entering eight “Miscellaneous Symbols and Pictograph” block characters, eg 🏩 and nearby, but upon submit it changes to a red “too short”. I have to go the full ten characters even with all non-ASCII. After the password change, I was able to login with both FF and Chromium.
Testing again, now that I know my password manager is 🏺 safe. The same thing happens now: enough emoji to get a green “okay” is not enough to actually work. And as I tried longer and longer passwords, iteratively, it logged me out, I think on the third try. When I did successfully set it, to a 🔟 emoji password, I still got a “you have been logged out” message flash by, but it didn’t actually log me out.
Not sure if that log out thing is an emoji-specific bug or some sort of misguided (or at least unhelpful) feature. If it is a feature, please make the “you have been logged out” box explain why.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [7 באוגוסט, 2020, 9:39am UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/30 "2020-08-07T09:39:13Z")
Yeah, this is due to Javascript’s legacy causing it to mis-count the length of strings containing emoji (and other Astral Plane characters). The server counts the length correctly.
[Previous page](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207.md?page=1)