r/webdev • u/Beatsu • Aug 02 '26

Question Tab as password?

Post image

SAS disallows spaces in your password. My password manager suggested an invalid (but secure) password.

So now that I have to make my own password: Out of spite, hypothetically, what implications could having tabs in my password have?

586 Upvotes

93% Upvoted

142 comments sorted by

View all comments

8

u/tajetaje Aug 02 '26

On a well implemented backend? Nothing. On one that doesn’t sanitize inputs or does stupid things with them? Could break their parsing or data storage, probably no sap injection vulns there though. I imagine the reason for disallowing spaces is so people don’t get confused by things like multiple spaces when they thought there was one, or trailing spaces

2

u/TramEatsYouAlive Aug 02 '26

I have seen a banking app (web-based), that will think that "password" and "PaSsWoRd" are essentially the same. Which led me to believe that they are not hashing passwords on the backend and storing them in some different way...

3

u/theScottyJam Aug 02 '26

Or they always lowercase before hashing.

But that's a weird thing to do.