# Min Password Length vs Block Common Passwords

**URL:** <https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207>\
**Category:** Feature\
**Created:** [2. März 2017 um 04:50 UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207 "2017-03-02T04:50:32Z")\
**Posts on this page:** 1\
**Showing post:** 23

<div class="post-metadata">

**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\
**Post date:** [14. März 2017 um 23:21 UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/23 "2017-03-14T23:21:56Z")

</div>

Taking the string " 🙂 " as an example, javascript says

```plaintext
"😀".length = 2

```

and Ruby says

```plaintext
"😀".length = 1

```

* * *
Which is the correct implementation here? @codinghorror's blog post says:

> [@](#):
>
> Enforce a minimum Unicode password length

because it’s nice and simple for users. So 🙂 is one character. That sounds reasonable to me.

However… the blog also says

> [@](#):
>
> If you paste the above four Unicode emojis into your favorite login dialog (go ahead – try it), to discover that it … isn’t in fact four characters.

This is indeed true of the Discourse password fields - one emoji = 2 characters. So if it’s showing as 2 characters in the password field, surely that should count as 2 characters in a password 😖

* * *

On a related note, it is currently very difficult to type emojis directly into html password inputs - you can only copy/paste them in. This is the case on Chrome on mac (using system emoji window), and also Safari on iOS (the emoji button doesn’t even show up with the password field focused). So, as much as I try, I can’t use ✅ 🐎 🔋 📎 as my password on Discourse (without cheating with copy/paste).

---

_[View the full topic](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207)._