Does Keycloak apply unicode normalization to passwords? if so, which one and when? #44085

tbroyer · 2025-11-10T15:34:02Z

tbroyer
Nov 10, 2025

I've been unable to find the information in the docs or a cursory look at the code: does Keycloak apply Unicode Normalization to the passwords? And if so, which normalization? and when? (just before hashing, or before going through password policies)

NIST 800-63-4 says:

If Unicode characters are accepted in passwords, the verifier SHOULD apply the normalization process for stabilized strings using the Normalization Form Canonical Composition (NFC) normalization defined in Sec. 12.1 of Unicode Normalization Forms [UAX15]. This process is applied before hashing the byte string that represents the password. Subscribers choosing passwords that contain Unicode characters SHOULD be advised that some endpoints may represent some characters differently, which would affect their ability to authenticate successfully.

But note that in the previous version (800-63-3), it said to apply NFKC or NFKD rather than NFC:

If Unicode characters are accepted in memorized secrets, the verifier SHOULD apply the Normalization Process for Stabilized Strings using either the NFKC or NFKD normalization defined in Section 12.1 of Unicode Standard Annex 15 [UAX 15]. This process is applied before hashing the byte string representing the memorized secret. Subscribers choosing memorized secrets containing Unicode characters SHOULD be advised that some characters may be represented differently by some endpoints, which can affect their ability to authenticate successfully.

Navigation Menu

Repository navigation

Does Keycloak apply unicode normalization to passwords? if so, which one and when? #44085

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Does Keycloak apply unicode normalization to passwords? if so, which one and when? #44085

Uh oh!

tbroyer Nov 10, 2025

Replies: 0 comments

tbroyer
Nov 10, 2025