When registering should the passwords match/don't match still be shown if the initial password isn't strong enough

Question

In a registration page the user is asked to enter a password. There are some (simple) rules for the password, so if the user enters "123" the text "password is too simple" will appear beside the input field. In the second password field if the password entered matches the password in the first, the message "passwords match" is displayed beside the second password input field.

My question is should "passwords match"/"passwords don't match" still be displayed even when the password entered does not meet requirements? Note that the password is only checked in the first password input box to see if it meets requirements.

EDIT: I forgot to add that if the user has entered passwords in both fields and goes back to the first and makes and changes the second field is automatically cleared.

Answer 1

If you are going to enforce a policy on password strength, I would suggest the following approach:

If the password which the user typed in does not meet your criteria then you display the message 'Weak Password. Make your password stronger by using ...' and ask them to try again.

Even if the user moves on to the next (retype) field, show the error in the first field only. So when the password is valid, you immediately get the error for mismatch and you fix that (Or better, whenever the user changes password, the reenter field is cleared for fresh entry). There is no sense in saying 'Invalid password' AND 'Password mismatch' since it is a hierarchical logic and if the password is invalid, there is no reason to match the passwords at all.

I would avoid block the user's access to the second password since it feels as if the user is not in control (the system is forcing user to do stuff). Let the user access whatever field in whatever order they feel like, but show the validation and other warnings/errors in your logical order.

eg: Gmail's signup process does not show mismatch if password is weak.

Answer 2

It depends on your policy.

• Weak passwords are allowed. Warn the user of weak password and display "match/don't match" message beside second password field. This is feedback (display system status) principle.
• Strong password only are allowed. Make second password field disabled. Display error on weak password. Enable second password field after user entered strong one in the first field. This is error prevention principle.

• Push to strong passwords. In this mode you gently push users to set strong passwords. To motivate them for strong passwords don't just warn weak, moderate or strong password. Instead warn in more convinced way:
  · weak, could be hacked in 2 sec (red)
  · moderate, could be hacked in 5 days (orange)
  · strong, still could be hacked in 10 years (green)

  Function to calculate hack period shouldn't be precise, it just has emotional and motivating sense.

Answer 3

The best way is to disable the confirm password field until the new password matches the requirements. This way, the whole problem is solved in a much better way.

But if you want it this way, then yes, it is better to show passwords match/don't match even though they don't meet the password strength criteria.

Answer 4

The message of passwords match / passwords don't match should definitely be displayed to show the user that the passwords he entered has some mistakes.

Also from TESTING perspective, it is correct that the contents should be cleared if the contents from first password textbox are changed.

It is completely OK to check the passwords in the first field only as the comparison/verification of the two passwords will be there in the next step. So if the user doesn't enters the required password then he will be shown error besides the first textbox itself.

Actually these are two totally different things : Checking of passwords is for the contents of the textboxes and the user will take care of requirements for password if the guidelines are mentioned clearly.

Hope this will make your doubt clear.