Should I limit the allowed characters in a password?

Question

Passwords

Is it worth limiting the range of allowed unicode characters in the password, are there any pitfalls if you allow the user to enter any characters, incl. emoji?

Answer 1

It depends where and how you will use these passwords. For example, built-in HTTP and SMTP authorization does not have the ability to pass a character encoding, and it is generally not recommended to use non-ASCII characters in it. IMAP uses UTF-7 which can have problems with emoji transfer. SSH can also have problems passing non-ASCII characters, depending on the type of terminal. Mac does not allow you to enter Cyrillic passwords in passwords in a lot of places, for example for WiFi.
As for the web - well, imagine a user registering a password with an emoji and then trying to log in with this password via a mobile phone, where there simply will not be an opportunity to enter it.

Answer 2

more character set - less realistic brute force.