A widely shared tip says you should always put a semicolon in your passwords, because if they ever turn up in a data leak it will break the CSV. Grok, asked to confirm, said that can happen with a sloppy file, then called the idea fun sabotage, not real protection.
The tip had already circulated a few hours earlier in Portuguese, with a comma instead of a semicolon. William Alves, who posts as lavemowill, wrote: “Sempre coloque uma vírgula (,) em suas senhas. Se algum dia acabar em um vazamento, quebrará o CSV.” In English, that is: always put a comma in your passwords; if they ever end up in a leak, it will break the CSV. Grok replied in Portuguese that, if the file does not put quotes around its fields, a comma in the password shifts the columns and messes up the file, and called it a classic trick for getting in the way of someone trying to parse a leak.
Sempre coloque uma vírgula (,) em suas senhas. Se algum dia acabar em um vazamento, quebrará o CSV. Confima @grok?
November 11, 2026
Later, Milady Queen, who posts as MiladyQueenX, swapped in a semicolon and tagged Grok again.
Always put a Semicolon (;) in your passwords. If they ever end up in a data leak, it’ll break the CSV. Confirm @grok?
November 12, 2026
Grok’s English reply was more tightly drawn. Many locales and tools, it said, treat a semicolon as the CSV delimiter instead of a comma. An unquoted semicolon inside a password field can then split the row for a naive parser. A file that follows RFC 4180 quotes that field and survives it, “but plenty of real-world leaks are sloppy.” It closed: “Fun sabotage, not real protection.”
Yes, it can. Many locales and tools treat ; as the CSV delimiter (instead of ,). An unquoted semicolon inside a password field then splits the row and corrupts the dump for naive parsers. Proper RFC 4180 CSV quotes the field and survives it, but plenty of real-world leaks are sloppy. Fun sabotage, not real protection.
November 12, 2026
CSV, or comma-separated values, is a plain text way of storing a table. Each line is a row, and a delimiter character, usually a comma, marks the break between columns. RFC 4180, the 2005 memo that documented the common format and registered the text/csv type, says a field that contains a comma, a quote or a line break should be wrapped in double quotes. A password written as “secret;value” then stays in one column.
The catch is that not every file called a CSV uses a comma, and not every export follows the memo. Microsoft documents that Excel uses the Windows list separator when it opens or saves a .csv file. In many locales where a comma is the decimal mark, that separator is a semicolon. An unquoted semicolon can split a row in those files the way an unquoted comma can in a US or UK export. A quoted field still holds together either way.
The larger limit is how passwords are stored. Well-run sites do not keep the password itself. They store a salted hash, a one-way value derived from the password with a method such as bcrypt or Argon2. A leak of that database then contains the hash, not the original characters, so a semicolon or a comma in the password never appears in the file. Grok made the same point in follow-up replies: the tip only matters against rare plaintext dumps from sites that already ignore basic password storage.
Leaked credential files also circulate as JSON, SQL dumps and simple email:password lists, which are not split on commas or semicolons in the same way. Some login forms reject a semicolon or a comma, so the character is not even available everywhere.
Grok’s later replies, like standard password guidance, still point to a long unique password for each account, a password manager, and multi-factor authentication. A semicolon can be one character among many in a strong password. It is not a defence against a breach.
Discover more from Sulat AI & Tech News
Subscribe to get the latest posts sent to your email.
