r/webdev • u/Beatsu • Aug 02 '26
Question Tab as password?
SAS disallows spaces in your password. My password manager suggested an invalid (but secure) password.
So now that I have to make my own password: Out of spite, hypothetically, what implications could having tabs in my password have?
586
Upvotes
1
u/taotau Aug 02 '26
Disallowing spaces is wrong and probably stems from the early days of systems where passwords were simply checked for a-z A+Z 0-9 out of habit and was embedded in early hashing algos so it has just hung around. There is no technical reason for not allowing spaces.
A tab is actually one of a set of special control characters that have specific meanings to computer systems. Others include carriage return, line feed, form feed, vertical tab, bell, eascape, interrupt, suspend etc. these are encoded in the first 32 characters of the ASCII character set, the grand daddy of all modern character encoding systems.
Text handling applications will typically send characters below 0x20 to a special handler to perform some system function and never pass them to the standard text processor. In most text editors for example, hitting tab will insert 2, 4, or 8 spaces, or if you're on the other team, it can sometimes directly insert the tab character (I am so glad that holy war is over - I was always on the spaces team).
So as mentioned hitting tab in a typical web form is intercepted by the browser and moves the cursor to the next item in the tab list, so the password field will never see it.
There are also places you might need to type a password that normal users would never see, like many command line interfaces in a terminal, or sometimes systems might be passing plain text passwords to other systems in the background, many legacy systems wrappers would use this technique, and special characters come into play.
Pasting a password is not a supported use case as that probably means that you have your passwords stored somewhere in plain text which is a bad idea - yes I know password managers use paste, but that's a niche use case up until fairly recent times (computer systems and libraries move fairly slowly, and password managers have only become common in the last few years).
TLDR, tab is forbidden because it is part of a set of special characters that have historical low level uses that still come into play today. Nothing wrong with spqces