NSA’s own website won’t accept passwords longer than 12 characters

Graham Cluley
Graham Cluley
@[email protected]

Want a job at the NSA?

Be aware that they don’t like it if your password is longer than 12 characters:

NSA password limit

Okay, so this is just the careers portal part of the NSA’s website. It doesn’t mean that everything at the NSA is protected by a password of 12 or less characters. But it’s not exactly the finest example to set for others, is it?

Sign up to our free newsletter.
Security news, advice, and tips.

I checked it out for myself, and had to raise an eyebrow at the following pop-up message that the NSA’s website displayed:

NSA secured

It’s good to see that the NSA are using HTTPS/SSL to protect our private information in transit. Oh, wait… hang on a minute…

As Martijn Grooten points out, this “may be a rare case in which there’s really no one but you and the site who sees your traffic.”

A cynic might suggest, of course, that all the NSA are doing is encouraging people to use shorter, weaker passwords for perfectly understandable reasons.

Hat-tip: @tdhopper

Found this article interesting? Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

Graham Cluley is a veteran of the cybersecurity industry, having worked for a number of security companies since the early 1990s when he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows. Now an independent analyst, he regularly makes media appearances and is an international public speaker on the topic of cybersecurity, hackers, and online privacy. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

3 comments on “NSA’s own website won’t accept passwords longer than 12 characters”

  1. Surely the example they *want* to be setting to others is "Please make your passwords as hackable as possible"? So this is ideal.

  2. Paul

    Ahhh… memories…


What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.