Don’t enforce password character limits


MyBB sites, such as, enforce bad password policies:

Please correct the following errors before continuing: The password you entered is of invalid length. Please enter a password between 6 and 30 characters.

The 30-character limit doesn’t matter, it gets salted and hashed either way. It’s an entirely arbitrary limit that renders passwords less secure. Don’t do it.

Even better, call then passphrases, because that’s what they should be.

Author bio and support


Ruben Schade is a technical writer and IaaS engineer in Sydney, Australia who refers to himself in the third person in bios. Wait, not BIOS… my brain should be EFI by now.

The site is powered by Hugo, FreeBSD, and OpenZFS on OrionVM, everyone’s favourite cloud infrastructure provider.

If you found this post helpful or entertaining, you can shout me a coffee or buy some silly merch. Thanks!