Shaming sites with dumb password rules.

Feel free to submit a pull request with dumb rules you've encountered.

See other sites for the formatting and follow these rules:

• Include the name of the site with a link.
• Add a clean comment about the dumb password rule (optional).
• Include at least one screenshot.
• Keep the sites in alphabetical order.

Sometimes I forget that caps-lock is on, glad it doesn't matter.

Their site says "All information is kept safe and secure." Just not as secure as you'd like.

User Password must be between 6 and 14 characters and contain 1 numerical value.

Between 8 and 16, so I can't go up to 20. Oh, and thanks for restricting one of the most common special characters!

Your password contains characters not listed. Therefore, they do not match.

8 to 15 chars. No special chars allowed but requires special chars. Also requires lowercase, uppercase, and numbers. Consecutive chars are prohibited. Did I mention the page hangs while you type? That eye icon tho.

You can enter whatever password you like! But you probably don't want to make it too long, because you'll break us and you'll never be able to login again.

The auto-generated strong password is not a valid password ! Blacknight use Odin for it's admin panel.

They force you to enter a password that has 8, 9, or 10 characters, then they lecture you on how to create a strong password.

16 maximum and no special characters. Protecting your US healthcare information.

Password must be exactly 6 characters long and no special character.

They also prohibit pasting into the password field by using a JavaScript alert() whenever you right-click or press the Ctrl button, so you can't use a password manager.

We don't even want you to login online.

Your password should be difficult to guess as long as it's not over 16 characters long.

Min 6 and max 8 characters for password! Can't contain anything different than letters and numbers. Apart, the email address must have at least 8 characters (sorry million dollar domain owners! :D)

No more than 20 characters and leave out characters commonly used by programmers. We don't want you to hack the mainframe.

"Our duties are wide-ranging, and our goal is clear - keeping America safe."

Some characters are too special.

We store basically all of your data, but we can't store your password.

Izly by Crous is an imposed French payment service for the university. You can't pay your daily meal without that because yeah you know cash is an ancient dumb thing.

Your username is [email protected] or your phone number. We only allow you a fixed 6 numbers password. Oh yeah we also block your account after three failed atempts. How convenient when the only thing you need to know is the name of someone and where they study. How convenient indeed.

Oh and also look we got pages NOT TRANSLATED IN FRENCH because duh.

Passwords must be between 8 and 20 characters, and some special characters are allowed. Users with randomly-generated passwords may find it particularly annoying to generate a password that works for their password safe.

What doesn't seem to be a problem for personal accounts, is for work accounts from Microsoft (e.g. Office 365 etc.).

Maximum 16 characters. So forget about using your new fancy diceware password here - or really any secure passwords in general.

Oh - and besides that, please don't use any "exotic" symbols, like ¤ or €. Or the letters Æ, Ø or Å from the Danish alphabet. They all are supposedly "spaces".

You "may use special characters", but only some of them - and we won't necessarily tell you which ones.

It only accepts lowercase letters, uppercase letters and numbers (any other character counts as forbidden character).
Also, if your password contains any invalid character, it will get marked as "Identical to the former 10 passwords".

To make it more fun, during the registration, it allows to set a 24 characters password to login to their website.
Once you try to login with the password, it will say that the maximum length accepted is 16 characters.
What actually happens, is that they let you insert 24 characters during registration, but only the first 16 will get actually used as password.

Min 7 and max 8 characters for password! Also to be different than the username: the user name is automatically generated and is based on the surname of the user with some characters replaced by digits :)

Has been that way for more than 10 years.

Not really a password rule per se, but the 2FA entry field has optional buttons for incrementing and decreasing the code value. Yes, those buttons allow you to go into the negatives.

We'll tell you not to use your name as your password, but we won't tell you how we restrict your password choice otherwise.

Passwords between 8 and 9 characters are the best.

Passwords limited to 8-12 characters.

/\d{6}/

„Sparkasse“ is a group of banks which is pretty popular in Germany. It calls its passwords „PIN“ („persönliche Identifikations-Nummer“ — personal identification number), the rules are pretty horrific and its not even a number, even though it is called as such! Here is a screenshot from the branch where I am from (Jena, Germany), but since they have a central IT, I think it will be identical in other branches:

The rules are as such:

• Only 5 characters
• Small letters (a-z)
• Large letters (A-Z)
• Numbers (0-9)
• „Special“ characters: ä,ö,ü,Ä,Ö,Ü and ß (Not suprising for a german Company)

After the rules there some hints on how the password should not look like:

• Combinations of your initials and the birthyear
• Your phone number or parts thereof
• Your zipcode
• Commom combinations like 123ab or 55555
• Full or parts of your login credentials

Sprint "upgraded" their security and disallow special characters.

Financial services - where we don't allow you to create the strongest password possible.

Pick from an arbitrary list of symbols, and no repeating characters.

Your password needs to be between 8 and 10 characters long, with no spaces, and must contain only numbers and letters. The first character must be a letter.

You can only use PIN as your password.

Your password needs to be between 8 and 10 characters long. Previously this would silently truncate the password without warning, causing confusion when the password wouldn't work.

Your password length is limited between 6 and 12 characters.

Your password must be between 6 and 14 characters.

We put punctuation in the list of unusable characters to make it additionally confusing.

Your password on an Identity Theft Protection service is limited to between 8 and 20 characters. Your username is allowed to be longer than your password.