156

It would be easier to ask for a user's password only once during registration.

The problem: The user could make a mistake while typing the password once because of hiding letters.

The solution: The user could have a toggle button for showing or hiding the password.

unmask password

Working example with toggling the visibility of the password. This approach could be used on the registration or login page.

Are there any benefits to asking a user's password twice during registration vs just not masking the password? Why would you ask twice?

P.S. Jakob Nielsen about unmasking the password:

  • Users make more errors when they can't see what they're typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business. (Or, in the case of intranets, increased support calls.)
  • The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security.

Update: I created a WordPress plugin which unmasks the password field. So you may use it if you want to.

unmask password

Update 2: WordPress.com use same technique to show and hide password.

Update 3: Internet Explorer 10 added a toggle password visibility icon. It looks like this:

IE 10 password

Update 4: Article about unmask password on smashingmagazine.

Update 5: Example with unmasking password on focus.

Improve this question
28
  • 2
    Related: ux.stackexchange.com/questions/484/…
    – Ben Brocka
    May 4, 2012 at 14:41
  • 6
    Unlike the other question I've tried to keep this question focused on masking vs unmasked passwords. A problem with the old question is that most of the "answers" are opinions or completely alternate ways to handle the situation (don't have a password, use openid ect). Please keep answers related to the actual question.
    – Ben Brocka
    May 4, 2012 at 15:13
  • 6
    Better yet, use OpenID and avoid making the user create yet another account.
    – 200_success
    May 4, 2012 at 17:50
  • 2
    Regarding Nilsen's second point, part b: If the user is copying and pasting from something like KeePass, then there is arguably security gain, not loss. This is also another reason not to have a "repeat password" field: I'm copying it anyway, the enter-twice method is not gonna "catch" any errors (which KeePass, presumably, somehow magically introduced).
    – Superbest
    May 5, 2012 at 13:37
  • 3
    ...Revealing my password to me would not help one bit, because I can't verify them. The ONLY way I can verify my password is correct is to type it again. Why? Because I don't know what my passwords are. I play keyboards, my password technique is to pick a tune, and play it as if the QWERTY row are the white keys and the numbers are the black keys (E.g: Inspector Gadget: qw3rt35wr3qw3rti7). All I remember is which tune I'm playing, what key it's in, how much of the tune to play. @Dean's answer below covers this, and is the reason you STILL need to ask for the password twice.
    – Lee Kowalkowski
    Jan 30, 2013 at 13:19

16 Answers 16

Reset to default
175

We should not ask for password twice - we should ask for it once and make sure that the 'forgot password' system works seamlessly and flawlessly

Improve this answer
14
  • 98
    @Roger - Making someone go through a (perhaps multi-step) password recovery process because they accidentally had CAPS LOCK on or mistyped a letter is a horrible User Experience. Additionally, showing passwords is not secure at all and in any eCommerce setting is bad practice. Having the user type passwords twice with good feedback, a la "Passwords Match!" or similar is common, useful and will provide users with the satisfaction of knowing they didn't mistype.
    – Tha Riddla
    May 4, 2012 at 15:43
  • 14
    So if I sign you up for an account and you get a e-mail verification link and don't click it, I should be able to spam you with forgotten password emails? Anyway, you need some other form of identification for your forgotten password feature if password isn't the sole method of authentication. By relying on the forgotten password system like that, you're just making the e-mail so important that we'll need to enter that twice instead.
    – Janus Troelsen
    May 4, 2012 at 18:20
  • 6
    @JanusTroelsen Plenty of high profile sites manage without entering any details twice - for example ones I'm aware of include twitter, vimeo, gist, kontain, foursquare, digg, freindster, last.fm, stumbleupon, xing, typepad, yousendit, yelp, toggl, tumblr, dropbox, dribbble, bebo, flixster, disqus, harvest, trello, mailchimp, huffduffer, and bang.
    – Roger Attrill
    May 4, 2012 at 18:42
  • 73
    @Tha Riddla If users accidentally have CAPS LOCK on, having them type the password twice most likely won't help…
    – Ben Hocking
    May 4, 2012 at 21:31
  • 23
    @Dason that's kind of my point. Isn't your credit card number more important to you than your password? If passwords are double required in secret masked fields why does nobody care that the credit card number is entered in free visible text only once?
    – JonW ♦
    May 5, 2012 at 1:41
44

Like Roger says, ideally you can reset your password easily and securely, but there are certain times that's not an option.

If you're not validating email addresses it's more important that their login credentials are correct; if they lose their password it might be game over if they entered fake email information.

Assuming you have to have a password and you care that it's correct, which seems to be the basis of your question, you have two options:

  1. Don't mask and only ask once. This works great on personal PCs as masking has negative effects as you pointed out. Since PCs are largely personal this can be okay for many uses where privacy isn't a large concern.
  2. Mask, but use a confirmation. This is made necessary because of the potential for typos. For a secure login, the overhead of one field is easily outweighed by addressing the edge-case situations of over-the-shoulder reading.

Trust is an issue if you're not masking. In creating a prototype for an HCI course my team actually used this one password field, no masking approach (without thinking; we just didn't know how to mask passwords in the program). Two of our users (out of 10) were concerned that their passwords did not mask as they entered them. Just the act of seeing your own, unmasked password can be sort of jarring; we're all used to seeing it as a set of filled dots, after all.

Password masking is a convention and a certain amount of people are going to freak out if they don't see it, even if the security benefits aren't real, they are assumed. Definitely keep masking for any sort of secure site or when trust is an issue. I would need some good hard data before I'm comfortable with a no-masking approach on any sign up.

Improve this answer
13
  • 4
    I agree that seeing your password in plain text is generally pretty jarring. I did some research to see if I could find any data to support it, but unfortunately most of the plaintext password rage seems to be directed at companies who email you passwords in plaintext. Still, it seems that a few people disagree with Nielsen on this one - the psychological aspects can't be ignored.
    – kastark
    May 4, 2012 at 15:19
  • 56
    You should never be able to recover your password. You should be able to regain access to your account and reset your password. If your password is stored in a way that it can be recovered, it's not stored securely. One-way hashing should be used to transform the original password into something unintelligible.
    – zzzzBov
    May 4, 2012 at 15:25
  • 1
    @BenBrocka: Could this example solve major part of problems? Problems like: asking password once, showing password for avoiding mistakes and hiding password for security.
    – webvitaly
    May 4, 2012 at 15:40
  • 1
    @zzzzBov Disagree on the never part. For most use cases one way hashes are the correct option; but when you need to provide application A the ability to automatically connect to application B while masquerading as you your application B password needs to be stored in a reversible form. Configuring one email account to access a second when the latter doesn't offer or has an up charge for forwarding service is probably one of the most common cases for this.
    – Dan Is Fiddling By Firelight
    May 4, 2012 at 15:49
  • 3
    @CharlesBoyung, when it comes to security, outliers are just as important if not more important than typical use. If you ignore edge cases as far as security is concerned, then you've left yourself wide open to a wide array of attacks, because attackers certainly won't ignore the edge cases.
    – zzzzBov
    May 5, 2012 at 18:03
30

I like the way Microsoft handles this in Windows 8. There is a single password field, and a button that displays the password while it is held down. That way, the user can check for typos. If the user enters their password with great confidence, then there is no need to enter it twice or look at it, but people who want to see if they typed it correctly can, and still don't have to type it twice. Because the button acts like a physical normally open switch, it masks the password on release helps keep the unmasked password from prying eyes.

Improve this answer
1
  • 2
    I agree this is a good solution: if you're on your own than you can choose to display the password. If you're in an open plan office you can choose to keep it masked.
    – PhillipW
    Sep 6, 2012 at 19:44
20

The double-entry system for passwords is standard and consistent, so I don't believe there's any significant usability harm in continuing to ask for it twice.

The purpose is simply verification to prevent the user from making more mistakes than necessary.

Masking and unmasking are not ideal options, as there are times when a user could be registering in a public place, or with people observing them.

As anecdotal support: I have had numerous times where I've signed up for an account at a friend's request, or for a particular class. It's much more secure to type my password twice with it hidden, than reveal hunter2 to everyone.

An alternative is to make the password verification an optional part of the sign-up process. The first entry is good enough, the second is there only as a fail-safe for the users convenience.

Improve this answer
2
  • 4
    Another thing about double-entry is that it helps the user remember newly created passwords.
    – RobC
    Sep 7, 2012 at 17:43
  • 2
    I stopped trying to remember passwords. I just auto-generate them and use a password store the keep track of them for me. Luckely, it auto-fills both password fields automatically with the newly generated password :-)
    – André
    Jan 29, 2013 at 10:44
14

Unmasking the password does not help for some users. If your password is mydogsname, then sure, but what if your password is 0rt(CH8gd!@$8? Some users use motion based passwords (their fingers follow a pattern) in which case they will not be able to easily notice a typo.

Also, some users use pass phrases instead of passwords, and the length of these will once again make it harder to spot a typo.

Improve this answer
6
  • It's worth pointing out that these are the only kind of passwords that really afford you a lot of protection. Words in the dictionary and personal information are usually easy enough to crack. Adding a digit at the end or l33ting it is usually only a little better.
    – rbwhitaker
    May 4, 2012 at 22:02
  • 3
    @rbwhitaker: No, such passwords are terrible because no one can remember them. A random 4 word sequence is as secure as 8 purely random characters, and easier to remember.
    – user9739
    May 5, 2012 at 8:55
  • @JoeWreschnig: What you're saying is true. If you can't remember them, or if you have the "PC Sunflower" (with sticky notes of all of your passwords stuck around the edges of your monitor), you have a different set of problems, but they're not very vulnerable to brute force guessing attacks. I, for one, am able to memorize these random passwords just fine. But Dean mentions pass phrases too, which as you, yourself, said, can be pretty effective. I was referring to both of these types of passwords. Either one is much more secure than more "traditional" passwords.
    – rbwhitaker
    May 6, 2012 at 1:26
  • 3
    One technique that never gets a lot of attention is password algorithms. You don't have to remember anything, since you generate a password based on something specific to what you need the password for. Every site you go to you just need to follow the steps you made up, and you'll get a unique password (most of the time).
    – Dean
    May 6, 2012 at 4:05
  • 1
    I mostly use completely randomized passwords, and what Dean says is true. I don’t know what a single password of mine looks like. It’s just a sequence of key strokes, done by muscle memory. If I need to remember a password exactly, I have to imagine a keyboard to be able to know it.
    – poke
    May 10, 2012 at 19:06
11

As Ben said, some users will be disturbed by unmasked passwords, for good reasons.

You could offer a toggle, but that won't really help users in this class. They'll know you intended for them to see their password (not a bug), but that doesn't provide reassurance.

In addition, if using the toggle control interrupts the flow of filling out the form, you have introduced a barrier instead of making it simpler. (Type password) - tab - (type password) is easy and common; is your flow as easy as that?

Another approach: I've never seen this on a desktop machine, but I have noticed that when typing passwords on my phone the device displays only the current symbol, masking the previous ones. I assume this is because of the high rate of inaccuracy on phone keyboards compared to physical ones. Perhaps you might look to see if anybody has explored that kind of interface on a desktop machine as an alternative to the double-entry. (But there will still be some user astonishment there; the first time I typed the first letter of a password on my phone I was certainly surprised.)

Improve this answer
4
  • 2
    Why the downvote?
    – Monica Cellio
    Jun 12, 2012 at 21:09
  • In addition, if using the toggle control interrupts the flow of filling out the form, you have introduced a barrier instead of making it simpler. (Type password) - tab - (type password) is easy and common; is your flow as easy as that? That's easy to prevent. Use tabindex in your input-elements.
    – Victor Bjelkholm
    Aug 31, 2012 at 19:40
  • @VictorBjelkholm, that's one way to address it. Another it to put the toggle checkbox above the password inputs. The implemenation has to consider this aspect of the UX and we can't take that as a given, unfortunately. I still think it's a bad idea for the other reasons given here.
    – Monica Cellio
    Aug 31, 2012 at 20:02
  • well, the checkbox would also need to use tabindex or else the username -> tab -> password flow is ruined.
    – Victor Bjelkholm
    Aug 31, 2012 at 20:29
4

Mistakes while typing the password is the best reason why websites ask the user to confirm their password. In most websites/forms, the second password type validates that both texts match and flashes an error if they don't match.

Read through the link you have mentioned but still toggling the visibility of password is still a security issue and users shouldn't be given an option.

Improve this answer
3
  • 1
    "the second password type validates that both the txt matched" - if user switched to french language keyboard accidentally but he wanted to type the password with english letters. So user thinks he is in English but he typed twice french letters. Both "french" passwords match each other and registration was successful but user remember the "english" password. So user cannot login because he cannot enter his "english" password because it is saved as "french". The best solution for this is to give option to show the password and there is no need to ask the password twice.
    – webvitaly
    May 4, 2012 at 14:42
  • 3
    Agree. I have faced this problem where CAPS LOCK was on for some reason and I just couldn't login later. Retrieve password made me realize the mistake - though I believe we shouldn't have retrive password option at all. It should always be recreate new password.
    – bschandramohan
    May 4, 2012 at 14:45
  • 2
    @ChandraMohan: that's why many login dialogs now display messages about caps lock, either immediatly, or upon a login failure.
    – Marjan Venema
    May 5, 2012 at 9:03
2

Windows Phone 7 has an interesting solution to this problem. Typos are so common with the on-screen keyboards that it makes a lot of sense that they spent the extra effort here.

You'll see the last character you typed into the password field for 2 seconds before it turns into a *. I pretty much duplicated this functionality with some JavaScript just now... http://jsfiddle.net/SWortham/rQJaP/13/embedded/result/

Someone looking over your shoulder would really have to have their eyes glued to the screen as you're typing to decipher your password. And yet, for those paying attention to the screen as they type, it'll help prevent the stupid mistakes like having CAPS LOCK on, or simply hitting the wrong key.

(There are some bugs with this when it comes to selecting and deleting the password. With a little more time these things could probably be worked out.)

Improve this answer
5
  • Pretty good solution of the problem. But I think this example - jsfiddle.net/webvitaly/Jdtke/embedded/result could solve major part of problems better. Problems like: asking password once, showing password for avoiding mistakes and hiding password for security.
    – webvitaly
    May 13, 2012 at 18:35
  • 1
    Android and iOS do this as well. It's helpful but not perfect for long passwords; if you type fast it's easy to miss one or more characters.
    – Ben Brocka
    May 13, 2012 at 19:18
  • @webvitaly - Yeah, I liked that approach as well. I can definitely see pros and cons of each.
    – Steve Wortham
    May 13, 2012 at 19:46
  • @BenBrocka - I agree, if you're typing fast it's hard to see every letter as you type it. But I do like how it solves certain problems without requiring the user to read and follow additional instructions, or toggle any options.
    – Steve Wortham
    May 13, 2012 at 19:48
  • Showing characters for 2 seconds is good but think ability to view all characters at once is still very useful if you want to verify the whole password or if you are trying to fix one char in the password. Seeing the last character doesn't help when fixing a password.
    – Anna Rouben
    Jun 11, 2012 at 18:46
2

Imagine situation like this.

Ordinary user who uses same password for each website (very simple one like 1980) accidentally clicks on show password button. His buddy sees that and logged in to Facebook and posted under his name. User will blame your website and told everyone that it is stupid and useless website. And how you know, one unsatisfied customer is equal to 20 satisfied customers but in a bad way.

Improve this answer
4
  • I'm not sure what this means regarding asking the password twice though. This situation would still happen if you asked for the password once or twice - if someone sees your password being typed in then it doesn't matter how many times you want people to type it in because if they know the password is 1980 then they'll type that in both boxes.
    – JonW ♦
    Mar 17, 2013 at 18:02
  • But in a ordinary case user types password in password box. How can other person see your password. My example was about show/hide button. I want to say that it is not a good idea.
    – TIKSN
    Mar 17, 2013 at 18:53
  • 1
    @TIKSN How often user is registering sitting near his friend? Even if such situation happens user will see after first letter that password is unmasked and will hit the button for mask his password. But even if there are no such button user at least could hide password on the screen with the hand while typing for mask it manually :)
    – webvitaly
    Mar 18, 2013 at 9:10
  • Will you hide password with your hand? I would not. You have to require as less as possible from user.
    – TIKSN
    Dec 22, 2013 at 17:38
2

The benefit of asking for the password twice during registration is that, if a user does not use a password manager or writes passwords down, it is easier for him to memorize the chosen password.

In German there is a saying like that knowledge goes from the hands straight into memory.

So if you have already typed the password 2 times during registration and a third time for the first login, the chances are pretty good that the user will remember the password.

Improve this answer
2

Asking for the password twice can lower your form conversion rate. Users end up correcting their input more and making more typos because they can't see the characters they're typing.

This article speaks more about that: Why the Confirm Password Field Must Die. It suggests using a 'show password' toggle button.

Improve this answer
1

How about give the option to the user? Provide in the form the unmask password or the a "Retype the password" option. Sometimes users are creating a registration and they don't want to use the unmask feature with someone nearby.

Improve this answer
1

Good for mobile UX

Another reason that entering a password twice is a good thing when people sign up using a mobile device is the frequency by of user typos. Have you ever tried typing a secure password (non word/phrase) 10 times in a row without errors on a mobile device?

Well sure, you and me can probably do it, but MOST cannot.

Improve this answer
1

From what I have seen through multiple usability studies, the biggest issues is that users don't pay too much attention when signing up. The more point of error is the email address. If users mistype their email address they won't be able to recover their account regardless of how well the password recovery module works.

Asking twice (or validating the email/username in whatever way) is far more important.

Improve this answer
1
  • I agree that the email is the most important part of user registration. But this is the theme for other topic. And the main idea of this thread is about masking or unmasking the password.
    – webvitaly
    Jan 29, 2013 at 14:53
0

Why unmasking the password might be bad

  • Shoulder surfing hazard, someone might see the passowrd on the screen as it is being typed if it is unmasked

  • Unmasking doesn't help sometimes if your password is complex, you might still type something thinking you typed something else

Why repeating the password is good

  • You can never make a mistake as the password is verified for both entries
  • Your password is safe from prying eyes as it is masked
Improve this answer
10
  • If user accidentally turned on CAPS_LOCK or switched language than typing "wrong" password twice is not good at all. But unmasking the password will show the issue immediately.
    – webvitaly
    May 22, 2015 at 3:42
  • @webvitaly But does the benefit of seeing what you type weigh more than the risk of having your password stolen? Somewhere in software production we have to compromise and I think compromising usability for security is acceptable, and the inverse is not true
    – ThaSaleni
    May 22, 2015 at 12:12
  • You are talking like if we should choose one or another. User can have toggle visibility button next to password and this will cover security and mistyping issues with one solution - signup.wordpress.com/signup But keep in mind that most of the passwords were not stolen by spies behind your shoulder :)
    – webvitaly
    May 23, 2015 at 7:25
  • well for me, there's a reason why on screen password mask was invented, and that reason is security, so by adding an option to undo that, you are to an extent defeating the purpose of that security, but then again, thats just my opinion
    – ThaSaleni
    May 23, 2015 at 11:24
  • Internet Explorer 10 added a toggle password visibility icon for every password field and I never heard the issue of millions accounts were hacked because of spies behind the shoulder during last 3 years ;)
    – webvitaly
    May 24, 2015 at 4:44
-2

you must not ask password at all: generate it automatically and send in welcome email.

  1. its easier for user to start
  2. its more secure

UPD

Why its easier to start.
Here is a worflow of my latest app:

  1. User come to site and open registration form. The only thing we ask is email address.
  2. When email is entered, we send autogenerated password like "fown7ucvd" on email and imideatly autologin user into his account and remembers him (cookies sliding expiration) for 20 days.

As the result:

  1. expremly easy to start
  2. user does'nt have to know at all that "there was a autogenerated password", his just start to explore my app.
  3. user does'nt have to enter any of his favorite password (ussualy one or two) also user does'nt have to enter 12345 in a password field. BTW this is why its most popular password -users are not dum, they just wanted to look at your service without entering a lot of personal data.

Why more sucure: The point about security is when you have one password for all resources, if password gets compromised, ALL data is in danger. So in general its more secure to autogenerate password.

Improve this answer
13
  • 3
    1) are you sure that with this "dfi&!ue.jx#%$h@!$df" it is easier to start than with this "chup@dora321" for example? :) 2) "chup@dora321" has almost same level of security that auto generated "dfi&!ue.jx#%$h@!$df". But it is impossible to remember this "dfi&!ue.jx#%$h@!$df" and it is bad UX.
    – webvitaly
    May 11, 2012 at 10:04
  • Here is a worflow of my latest app: 1. User come to site and open registration form. The only thing we ask is email address. 2. When email is entered, we send autogenerated password like "fown7ucvd" on email and imideatly autologin user into his account and remember him (cookies sliding expiration) for 20 days. The point about security is when you have one password for all resources, if password gets compromised, ALL data is in danger. So in general its more secure to autogenerate passwords.
    – ADOConnection
    May 13, 2012 at 9:29
  • 1
    @ADOConnection - There's basically no chance of a user remembering a password that was randomly generated for them. This will become an annoyance for any returning user. In fact, since you say that you've already implemented this solution I'd be interested to know what percentage of users change their passwords after registering.
    – Steve Wortham
    Jun 11, 2012 at 19:29
  • 5
    Email is not a secure storage for passwords. It adds all the intermediates between the email server and the email provider into the chain of trust for your site. And what about the password to access the email account itself?
    – Eric Bréchemier
    Sep 7, 2012 at 10:02
  • 2
    @ADOConnection - I have experienced this pattern first hand, and this gave me a bad feeling about the web site, leading me to wonder: if they think it is OK to send a password in plain text, are they also storing it in plain text in their database? And in one case, I was not even able to change the password, keeping the generated password was the only possibility.
    – Eric Bréchemier
    Sep 7, 2012 at 11:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.