A password field, described only as a shape

Session and account

A password is the only shape on this site you are not shown while you enter it, so everything you can learn about it comes from the field around it.

The shape

There is no format to state. A password is whatever the far side will accept, and different sites accept different things. What can be described precisely is the box: what it displays, what it silently refuses, what it silently keeps, and what those behaviours imply about the store sitting behind it.

This card describes that box. It contains no advice about choosing a value, no opinion on length, and no recommendation of any kind. That is deliberate and it is not an oversight.

What is displayed: one dot or asterisk per character, or nothing at all. The glyph shown is not the character stored
Alphabet: unconstrained in principle. Any restriction you meet was imposed by the form, not by the concept
Length: a maximum is often enforced by the box and a minimum is often enforced on submission. Neither is visible until you cross it
Whitespace: a leading or trailing space is a character like any other and is stored unless something strips it
Invisible characters: can be present without changing the number of dots you see in any way you could notice
Case: significant almost everywhere, and never signalled by the field itself

what the box shows for a value of twelve characters
●●●●●●●●●●●●

three values that look the same behind the mask
exampleexamp
exampleexamp[trailing newline]
example[no break space]examp

The bracketed markers stand in for characters that occupy space but draw nothing.

What a length limit implies about the store behind it

A maximum length on a password field is a fact about a system, not about a value. Its presence tells you that somewhere behind the form there is a column, a buffer or a legacy rule with a fixed width, and that the form was built to stay inside it.

The version worth knowing about is the silent one. Some fields simply stop accepting input at the limit, which you notice immediately because the dots stop appearing. Others accept everything you type, then keep only the first part. Nothing on the screen distinguishes these two.

A field that truncates silently can only be detected by its effects, and the effect is peculiar: a value that is wrong when entered in full and right when entered short. That is a shape fact about the field, discovered backwards from behaviour, and it is the one situation in this card where the outcome tells you something the display refused to.

What a character counter does and does not tell you

Some forms print a running count beside the box. The count is honest about one thing only: how many characters the box currently holds. It does not tell you which characters those are, whether any of them are invisible, or whether the store behind the form will keep all of them.

The counter is still useful, because it is the only view you have. If you paste a value you believe is twelve characters and the counter reads thirteen, something invisible arrived with it. That single comparison is most of what a counter is good for.

How to check it by eye

What the box will admit under observation

Compare the count with what you expect. A discrepancy of one after a paste is nearly always a trailing newline that came from the end of a line.
Paste into a plain text field first, where the value is visible, and look at the two ends before the mask hides them. The ends are where invisible characters collect.
Watch whether the dots stop appearing while you are still typing. That is a hard limit announcing itself, and it is the only limit that announces itself.
Look for characters an editor may have replaced: a curly quotation mark where a straight one was typed, or a long dash where two hyphens were. These are substitutions made by software on your side.

What a wrong shape means

The commonest wrong shape here is a value that is one character longer than the person believes, because a copy took the line ending with it. The second commonest is a space at the start or the end that survived a double click selection. The third is a substituted character, where an editor helpfully converted a straight quotation mark into a typographic one on the way through.

All three are transport faults. They mean the value was moved through something that edits text, which is most things. They do not mean the form is broken, and they certainly do not mean anything was intercepted.

A field that rejects a character outright is a different matter. That is a restriction the form chose, and it is a statement about the form only. Any conclusion drawn from it about the store behind it would be speculation, so this card draws none.

What a correct shape does not prove

Not that the value you typed is the value that was stored. Silent truncation, whitespace stripping and case folding all happen out of sight.
Not that the field is the field you meant to fill. Which host you are on is a separate question, handled at a host built from lookalike characters.
Not that the characters on screen match the characters in the buffer. The mask draws one identical glyph for every character, including the ones that draw nothing of their own.
Not that a value accepted once will be accepted again. Acceptance is a property of a record, not of a string.
Not anything at all about how the value is handled after submission. That is invisible from the form and this site makes no claim about it.

What this card is not

This is not guidance. It contains no view on how a password should be chosen, how long it should be, how it should be kept or what should be used to keep it, and it will not acquire one. Those are decisions this reference does not make for anybody. For the shape of a value that expires on a clock rather than persisting, see a one time code, and for the general thesis about limits see what a shape proves.

A password