Drop requirement for specific characters in passwords #227

New Issue

OVERLORD · 2026-02-04T17:57:46+03:00

OVERLORD commented

2026-02-04 17:57:46 +03:00

Originally created by @justinmayer on GitHub (Sep 2, 2022).

Recent changes to Planka now require a letter and a number when setting a password. While well-intentioned, this is not a recommended practice when enforcing password strength. Instead, the focus should be on overall entropy.

Per NIST guidelines, requiring specific character types in a password is not recommended (emphasis mine):

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

The present requirement actually lowers the entropy of resulting passwords by effectively making them shorter. It is harder to remember a short p@ssw0rd-style password than longer passphrases that may not contain any numbers, and long passphrases have significantly higher entropy and are thus far more secure.

Originally created by @justinmayer on GitHub (Sep 2, 2022). Recent changes to Planka now require a letter and a number when setting a password. While well-intentioned, this is not a recommended practice when enforcing password strength. Instead, the focus should be on overall entropy. Per [NIST guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html), requiring specific character types in a password is not recommended (emphasis mine): > **Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets.** Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator. The present requirement actually lowers the entropy of resulting passwords by effectively making them shorter. It is harder to remember a short `p@ssw0rd`-style password than longer passphrases that may not contain any numbers, and long passphrases have *significantly* higher entropy and are thus far more secure.

OVERLORD added the enhancement label 2026-02-04 17:57:46 +03:00

OVERLORD closed this issue

2026-02-04 17:57:48 +03:00

OVERLORD commented

2026-02-04 17:57:50 +03:00

@meltyshev commented on GitHub (Sep 2, 2022):

I completely agree with you. I plan to add a password strength bar based on https://github.com/dropbox/zxcvbn. It was just the first idea to fix the ability to have a 1 character password.

Or if anyone has other suggestions, we can discuss here.

@meltyshev commented on GitHub (Sep 2, 2022): I completely agree with you. I plan to add a password strength bar based on https://github.com/dropbox/zxcvbn. It was just the first idea to fix the ability to have a 1 character password. Or if anyone has other suggestions, we can discuss here.

OVERLORD referenced this issue

2026-02-04 21:40:51 +03:00

[PR #227] [MERGED] DB Migration: ProjectManager wrong "down"-name #959

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/planka#227