Dumb Password Rules is a curated collection and website that documents poorly designed password requirements from real websites.
The project addresses the problem of unnecessarily restrictive password policies that harm user security and experience. Sites often impose arbitrary rules like character limits, character type requirements, or restrictions on special characters that contradict security best practices. The tool compiles these examples in a public database accessible at dumbpasswordrules.com, making the prevalence of bad password rules visible and serving as a reference for what not to do when designing authentication systems.
The project welcomes contributions from anyone who encounters problematic password rules in the wild. Contributors can submit new sites through pull requests on GitHub or, for those unfamiliar with Git workflows, by messaging the maintainer directly on Mastodon with the site name, a link to the offending rule, a screenshot, and a written description. The site also runs a bot that periodically posts random rules to Mastodon and Bluesky, helping spread awareness of these poor practices. This is useful for security professionals, developers designing authentication systems, and anyone frustrated by unnecessarily complex password requirements who wants to see they are not alone.
The project maintains an open contribution model that explicitly lowers barriers to entry for non-technical contributors. The maintainer actively responds to direct messages and manually adds submissions from users who cannot use GitHub. Code improvements and bug fixes are also welcomed, with the maintainer encouraging discussion via issues before submitting changes. The project accepts contributions across multiple channels and maintains accessibility for contributors at different technical skill levels.
