What is the maximum number of characters that a Salesforce user password can have?
According to Setting Password Policies:
User passwords cannot exceed 16,000 bytes.
How does that translate into characters that the user would enter in the browser for their password?
Firstly, what character encoding is Salesforce using?
This I think I can answer:
Internationalization and Character Sets
[…] The character set for your organization depends on the Salesforce instance your organization uses. If your organization logs into
ssl.salesforce.com, then your encoding isISO-8859-1. All other instances useUTF-8. You can determine the character set for your organization by callingdescribeGlobal()and inspecting the encoding value returned in the DescribeGlobalResult.
UTF-8
With UTF-8 it looks like the a character could be 1, 2 or 4 bytes (Ref: What is the maximum number of bytes for a UTF-8 encoded character?). So, I think, if all the characters were in the U+0000 to U+007F code point range then I could get up to 16,000 characters in a password.
In the ideal world this would never be an issue with API integrations and I'd use an OAuth refresh token to maintain a session from an external system.
This question came about with an older system that had a maximum password length of 36 characters. I'm looking at increasing it, but getting a defined maximum password length isn't as straight forward as you might think. Ideally I won't be replacing one arbitrary upper limit with another one.
I personally haven't encountered any 8000+ character passwords. They are hard to remember and difficult to type out. But the potential exists.
Best Answer
Any character can be a 1 'code-point' or a combination of two 'code-points' (e.g. á can be described as two code points (a+') in one character) and every code-point can be 1 to 6 bytes (or 4, since the 2003 spec).
So theoretically one character could use up to 12 bytes.
Now I don't think that will happen, and in the new spec 8 bytes would be the max, but if you want to be safe I would divide that 16,000 by 12. Now that still gives plenty possible password for a user to choose from, I would say :-)
Oh, and this is a great read: http://www.joelonsoftware.com/articles/Unicode.html