If your security relies on a password, you will always be anxious that somebody, somewhere, has somehow figured out what it is and already has access to your bank account.
No I won’t. All my passwords are something like I0!2b6KJ!eA04WiJ&&MFToCQ7CN*4mvb and each is used for only one thing because I’ve been using a password manager for over a decade.
I switched to using a password manager last year that scrambles all of my passwords like how you describe, and hot damn is it nice, both in terms of security and convenience.
Most do. Source: I usually use passwords that long.
Maybe 1 in 10 don’t, and I find that annoying since 32 characters containing only lowercase real words and spaces has several times as much entropy as 8 characters of random mixed case letters, numbers, and symbols.
I default to using 128 characters because that’s the max for the password generator I use. A surprising amount of accounts are OK with that, like more often than not. I have pared accounts down massively since using a password manager though, and use privacy respecting services when possible, so I may be self selecting here.
It’s interesting to say more often websites are ok with that length. I do know that some websites truncate passwords so a long 128 character password may end up being a 16 character password and it all still works despite the password being that long.
That’s why I always click the eye to see it if possible, and log in on another device with the password manager after changing/creating a password. I’ve only had that happen once or twice though.
Even if the password box accepts the full string, some sites truncate it in the backend. A good test for this is to try logging in with your full password except for the last character. If that works, keep deleting characters until you can’t log in anymore, and then you’ll know how many characters it really supports.
Hopefully nobody still does this, though with the rise of vibecoding, who knows…
the vast majority of mine are +50 characters - you are just wrong. the services which strictly limit the length are rare and their security is suspect since they should be hashing your input anyway
I mean it’s probably a good idea to have some kind of limit in place, because you really don’t want to deal with attackers trying to transfer megabytes worth of text in the password field and triggering an OOM on your end. But this limit should still be pretty high ofc.
No I won’t. All my passwords are something like
I0!2b6KJ!eA04WiJ&&MFToCQ7CN*4mvband each is used for only one thing because I’ve been using a password manager for over a decade.Mwahahaa, I’m in
I switched to using a password manager last year that scrambles all of my passwords like how you describe, and hot damn is it nice, both in terms of security and convenience.
I don’t think any service allows passwords that long
Most do. Source: I usually use passwords that long.
Maybe 1 in 10 don’t, and I find that annoying since 32 characters containing only lowercase real words and spaces has several times as much entropy as 8 characters of random mixed case letters, numbers, and symbols.
Limiting password length is a red flag they are storing your password in plaintext. I’d be wary of using any service like that
I default to using 128 characters because that’s the max for the password generator I use. A surprising amount of accounts are OK with that, like more often than not. I have pared accounts down massively since using a password manager though, and use privacy respecting services when possible, so I may be self selecting here.
It’s interesting to say more often websites are ok with that length. I do know that some websites truncate passwords so a long 128 character password may end up being a 16 character password and it all still works despite the password being that long.
That’s why I always click the eye to see it if possible, and log in on another device with the password manager after changing/creating a password. I’ve only had that happen once or twice though.
Even if the password box accepts the full string, some sites truncate it in the backend. A good test for this is to try logging in with your full password except for the last character. If that works, keep deleting characters until you can’t log in anymore, and then you’ll know how many characters it really supports.
Hopefully nobody still does this, though with the rise of vibecoding, who knows…
the vast majority of mine are +50 characters - you are just wrong. the services which strictly limit the length are rare and their security is suspect since they should be hashing your input anyway
Didn’t know that. I stand corrected
I mean it’s probably a good idea to have some kind of limit in place, because you really don’t want to deal with attackers trying to transfer megabytes worth of text in the password field and triggering an OOM on your end. But this limit should still be pretty high ofc.
for sure, but limiting it under 64 (the length of a sha256 hash) isn’t ideal at all