"Your password can't contain spaces."
is a message I see from some websites,
including 1 .

Why?
(This question is very similar to Why Disallow Special Characters In a Password? , but the answers there don't seem to apply to the space character).

Some systems apparently strip out all spaces before hashing the password.
( How does Google not care about "spaces" in Application-specific passwords? )

Why not simply hash whatever the user typed in, spaces and all?

I can't explain it as anything beyond legacy madness, or lazily copying username restrictions to password restrictions without forethought.

Any block of data, printable or otherwise, should be acceptable if you're hashing your passwords. The only restrictions should be a minimum complexity and a "sanity" maximum length so somebody doesn't soak up 1MB of bandwidth (and the corresponding CPU time to hash the input because you use a slow algorithm, right?) every time they login.
