# Min Password Length vs Block Common Passwords

**URL:** <https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207>\
**Category:** Feature\
**Created:** [March 2, 2017, 4:50am UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207 "2017-03-02T04:50:32Z")\
**Posts on this page:** 1\
**Showing post:** 16

<div class="post-metadata">

**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\
**Post date:** [March 4, 2017, 11:52pm UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/16 "2017-03-04T23:52:00Z")

</div>

> [@sam](#):
>
> it enters the world of too configurable

Oh hun, that ship sailed a long, _long_ time ago… in particular, we allow reducing the minimum password length, and that’s arguably more “no, seriously, you don’t want to do that” than increasing the max password length.

I suppose we could benchmark where the CPU time required goes from “that takes a while” to “OMFG no wai!” (if that wasn’t how `200` was determined initially), but someone’s going to have a password that’s a bit longer than that, and a really fast CPU, and wonder why they can’t login…

---

_[View the full topic](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207)._