Can You Put Spaces in a Password?
Can you put spaces in a password? Yes. A space is a legal password character on any competently built site, and passphrases with spaces are easier to type and remember than the symbol salad most password rules push you toward.
Here is the sentence I keep coming back to: "correct horse battery staple" is a fine password. Twenty-eight characters, four spaces, typable on a phone without hunting for the symbols keyboard. The only thing standing between you and passwords like that is whether the site you are signing up for accepts spaces. Most do. Some do not, and the reasons are dumber than you would hope.
NIST says the space counts
The rulebook most security teams follow is NIST SP 800-63B. It says verifiers should accept all printable ASCII characters in a memorized secret, and it names the space character explicitly. Rejecting spaces is not a security decision. It is a bug that survived code review.
Plenty of large identity systems treat spaces as ordinary characters. Cornell's current passphrase rules count a space toward the 16-character minimum. Stony Brook's security office recommends spaces as a way to add complexity while keeping a passphrase memorable. When universities running identity systems for tens of thousands of people accept spaces, a random signup form that rejects them is behind the times.
What a space is actually worth
A space is not a trick. It is one character position drawn from the same alphabet as everything else you type. A four-word diceware passphrase has 51.7 bits of entropy whether the words are joined by spaces, dashes, or nothing at all. The spaces add no security by themselves.
They add something better: a 51.7-bit secret you will actually use. If you are skimming, that is the whole argument. Memorability is a security property. A passphrase you can type from memory on the first try is one you will not simplify, reuse across sites, or store in a plaintext note.
There is a second, practical win on mobile. The spacebar is the biggest key on the keyboard. A six-word passphrase with spaces is much faster to type on a phone than a 16-character string that sends you to the symbols page four times. You will feel this every time you log in on a new device.
Why some sites still reject spaces in passwords
Three reasons, roughly in order of how often they show up:
- Trimming. Some backends strip leading and trailing whitespace from every form field, passwords included. Your passphrase with a trailing space becomes a different string on the way in, then fails when you type the original later. Never start or end a password with a space. Interior spaces are fine.
- Ancient validation. A character whitelist written a decade ago is still running somewhere, silently rejecting anything outside its little alphabet. The code never got updated, and you get to deal with it.
- Paste paranoia. A few sites ban spaces because they worry users will paste a password with an accidental trailing space and lock themselves out. That is a UX problem with a UX fix. Trim on paste, warn the user, move on. It is not a reason to shrink the character set.
None of these make spaces unsafe. They make specific sites annoying. The fix belongs on their side, not in your password.
What I do when a site says no
Swap the separator, not the words. A dash or underscore between the same words keeps the length and the memorability. "correct-horse-battery-staple" is 31 characters and passes every validation rule I have ever met.
This is exactly what the separator option on the passphrase generator is for. Build the passphrase with spaces first, since that is what you will type in most places. If one stubborn site rejects it, regenerate with dashes for that site alone. Do not downgrade every password to satisfy the worst form on the internet.
My default is spaces everywhere they are accepted and dashes where they are not, with a password manager holding both so I never have to remember which site wanted what. The one passphrase worth getting exactly right is your manager's master secret, which is a separate decision: The One Passphrase Setup: Why Your Password Manager Deserves a Great Master Secret.
Frequently asked questions
Do spaces make a password stronger?
Not directly. A space is one character like any other, so "correct horse battery staple" has the same entropy as "correcthorsebatterystaple". The strength comes from length and randomness. Spaces earn their keep through memorability and typability, which are what keep a strong passphrase in use instead of written down.
Why does my bank reject spaces in passwords?
Usually legacy systems. Older mainframe-era backends and unmaintained validation rules only accept a fixed set of characters, and nobody has updated them. It is not a security feature. Use a dash or underscore as the separator for that site and keep spaces everywhere else.
Can I start or end a password with a space?
Technically yes on a correct implementation, practically no. Too many sites trim leading and trailing whitespace from form fields, which silently changes your password and locks you out later. Keep spaces in the interior only.
Do password managers handle spaces in passwords?
Yes. A password manager stores the exact string, spaces included, and fills it byte for byte. The only failure point is the site's own login form. If the form accepted the password at signup, the manager will replay it faithfully.
What should I use instead of spaces if a site rejects them?
Dashes first, underscores second. Both keep the words readable and the length intact. Avoid removing the separators entirely if you can, since "correcthorsebatterystaple" is harder to type correctly and easier to mistype on a phone.
Related reading: How Many Words Does Your Passphrase Need? Entropy Math, Worked Out · How to Remember a Long Passphrase · Should You Change Your Passphrase Every 90 Days? What NIST Says Now
One practical security guide a week. Get it by email.
Try the tool
Everything above is easier to believe once you have seen it in action. Generate a passphrase now on the homepage. It runs entirely in your browser and takes about three seconds.