What are the allowed characters for a password?

Question

I'm asking for the type of characters supported by user passwords (the passwd command precisely)

Are spaces allowed? NULL characters (\0)? a subset of ASCII or more?

If spaces are allowed do I need to escape them?

Answer 1

Based on testing:

• \0 is treated as marking the end of the password.
• Spaces are allowed. Though it isn't shown in the output below, by using CtrlV, I was able to use Enter, Esc and other keys in a password.

---

$ pwgen 10 1
Pohhei8sai 
$ passwd 
Changing password for muru.
(current) UNIX password: 
Enter new UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully
$ printf 'Pohhei8sai\n\0\b\n\0\b' | passwd
Changing password for muru.
(current) UNIX password: Enter new UNIX password: Retype new UNIX password: No password supplied
Enter new UNIX password: Retype new UNIX password: passwd: Authentication token manipulation error
passwd: password unchanged
$ pwgen 10 1
Uuxohv9moo 
$ printf 'Pohhei8sai\nUuxohv\09moo\nUuxohv\09moo\n' | passwd
Changing password for muru.
(current) UNIX password: Enter new UNIX password: Retype new UNIX password: Bad: new password is too simple
Enter new UNIX password: Retype new UNIX password: passwd: Authentication token manipulation error
passwd: password unchanged
$ printf 'Pohhei8sai\nUuxohv9moo\nUuxohv9moo\n' | passwd
Changing password for muru.
(current) UNIX password: Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully
$ printf 'Uuxohv9moo\ntesting 1\ntesting 1' | passwd
Changing password for muru.
(current) UNIX password: Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully

---

From my reading of the source, the passwd command uses the (obsolete) getpass function, which behaves pretty much like read -s (and marks the end of the password string with \0). It does not restrict the characters usable, aside from some checking of reuse and complexity. \0 cannot be used, since it gets treated as the normal end-of-string marker in C strings, but pretty much anything else can, such as the bell:

$ printf 'testing 1\nUuxohv\a9moo\nUuxohv\a9moo\n' | passwd
Changing password for muru.
(current) UNIX password: Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully