USAA is transferring all of its customers' brokerage and retirement accounts to Schwab. I just tried to initiate that transfer and was surprised to see that Schwab wouldn't allow me to use special characters in my new password. Is this probably an entirely technical limitation (the limitation is grandfathered in) or could there be some other reason?


Limiting the number of usable characters reduces the number of possible passwords, as well as the information carried by each individual character. Parsing special characters may require some additional technical overhead, and can be more cumbersome to enter, particularly on mobile devices or foreign keyboards. So, limiting the character space can be done for a few reasons, but none of them are to enhance security - on the contrary, limiting the number of available characters makes your password easier to guess.

That said, most passwords are not breached by brute-force cracking, which is what longer, more complex passwords are designed to prevent. A password with special characters in it is no different from a password without special characters, if it is compromised through social engineering attacks, phishing, or a compromised database. Password complexity is entirely orthogonal to susceptibility to those kinds of attacks.

  • It can enhance security in as much as availability is part of security. Often encoding issues (at least in pre utf8 and utf16 software) make it such that special characters may not match themselves when entered in different systems and lock users out. If this were a common problem on their system it could pose a security issue of users needing to reset their passwords or getting locked out easily. – Vality May 11 '20 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.