Hi I need to specify which characters are allowed in Vaultwarden. Currently you can set “Special characters” as policy:
Unfortunately our users are creating passwords containing ^, $ and % in the passwords which are sometimes causing problems in our scripts. Is there any way to specify which special characters are allowed? I am using Vaultwarden 2026.4.1
No, there is not since this is entirely a client-side feature. Cf.
A feature request like this has been made a long time ago.
But when we use the webclient from vaultwarden, and there also exist a policy how to prevent the use of special characters, why is it a client thing?
What policy would prevent the use of special characters? The password generator policy allows to set the minimum requirements, e.g. that you can’t generate a password without the use of special characters. It does not prevent you from adding further requirements. The setting is a boolean flag (and also a number if you want specify the quantity of special characters to include) and the interpretation of those fields happens client side and since we don’t modify the password generator of the modified Bitwarden web-vault that is shipped with Vaultwarden it will behave exactly like the one from Bitwarden.
The comment is a bit wrong (because it is a copy of the one from useNumbers) so you have to replace “digit” with “special character” but I hope you can see that this is not something that we can just change server-side without heavily modifying the clients.
