# Why impose limits on passwords?

**URL:** <https://boards.straightdope.com/t/why-impose-limits-on-passwords/742417>\
**Category:** Great Debates\
**Created:** [January 7, 2016, 3:04pm UTC](https://boards.straightdope.com/t/why-impose-limits-on-passwords/742417 "2016-01-07T15:04:53Z")\
**Posts on this page:** 2\
**Page:** 2

<div class="post-metadata">

**Author:** ![Duckster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duckster/32/1244_2.png) [@Duckster](https://boards.straightdope.com/u/Duckster)\
**Post date:** [January 8, 2016, 6:29pm UTC](https://boards.straightdope.com/t/why-impose-limits-on-passwords/742417/21 "2016-01-08T18:29:43Z")

</div>

Rule of Diminishing Returns.

A longer password does not necessarily provide for more account security if the average password user remains lazy in their overall security. At some point, password length and complexity forces too many to adopt a lazy approach for security of the password itself. At the same time, password forgetfulness increases, requiring system administrators to create easy tools for changing a forgotten password, again, and again, and again. At some point the, users will say fuck that and either abandon the account (if they can) or maintain easily available cheat sheets where they write down their accounts and passwords, thus defeating the actual intent.

Password length is about social engineering. It’s not a technical limitation.

---

<div class="post-metadata">

**Author:** ![Jayhawker\_Soule](https://avatars.discourse-cdn.com/v4/letter/j/57b2e6/32.png) [@Jayhawker\_Soule](https://boards.straightdope.com/u/Jayhawker_Soule)\
**Post date:** [January 8, 2016, 9:08pm UTC](https://boards.straightdope.com/t/why-impose-limits-on-passwords/742417/22 "2016-01-08T21:08:34Z")

</div>

What I would prefer to see is an international standard governing rules and character set.

[Previous page](https://boards.straightdope.com/t/why-impose-limits-on-passwords/742417.md?page=1)