Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

It would be easier to ask for a user's password only once during registration.

The problem: The user could make a mistake while typing the password once because of hiding letters.

The solution: The user could have a toggle button for showing or hiding the password.

unmask password

Working example with toggling the visibility of the password. This approach could be used on the registration or login page.

Are there any benefits to asking a user's password twice during registration vs just not masking the password? Why would you ask twice?

P.S. Jakob Nielsen about unmasking the password:

  • Users make more errors when they can't see what they're typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business. (Or, in the case of intranets, increased support calls.)
  • The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security.

Update: I created a WordPress plugin which unmasks the password field. So you may use it if you want to.

unmask password

Update 2: WordPress.com use same technique to show and hide password.

Update 3: Internet Explorer 10 added a toggle password visibility icon. It looks like this:

IE 10 password

Update 4: Article about unmask password on smashingmagazine.

Update 5: Example with unmasking password on focus.

share|improve this question
2  
Related: ux.stackexchange.com/questions/484/… –  Ben Brocka May 4 '12 at 14:41
5  
Unlike the other question I've tried to keep this question focused on masking vs unmasked passwords. A problem with the old question is that most of the "answers" are opinions or completely alternate ways to handle the situation (don't have a password, use openid ect). Please keep answers related to the actual question. –  Ben Brocka May 4 '12 at 15:13
5  
Better yet, use OpenID and avoid making the user create yet another account. –  200_success May 4 '12 at 17:50
2  
Regarding Nilsen's second point, part b: If the user is copying and pasting from something like KeePass, then there is arguably security gain, not loss. This is also another reason not to have a "repeat password" field: I'm copying it anyway, the enter-twice method is not gonna "catch" any errors (which KeePass, presumably, somehow magically introduced). –  Superbest May 5 '12 at 13:37
2  
...Revealing my password to me would not help one bit, because I can't verify them. The ONLY way I can verify my password is correct is to type it again. Why? Because I don't know what my passwords are. I play keyboards, my password technique is to pick a tune, and play it as if the QWERTY row are the white keys and the numbers are the black keys (E.g: Inspector Gadget: qw3rt35wr3qw3rti7). All I remember is which tune I'm playing, what key it's in, how much of the tune to play. @Dean's answer below covers this, and is the reason you STILL need to ask for the password twice. –  Lee Kowalkowski Jan 30 '13 at 13:19
show 23 more comments

11 Answers

up vote 87 down vote accepted

We should not ask for password twice - we should ask for it once and make sure that the 'forgot password' system works seamlessly and flawlessly

share|improve this answer
60  
@Roger - Making someone go through a (perhaps multi-step) password recovery process because they accidentally had CAPS LOCK on or mistyped a letter is a horrible User Experience. Additionally, showing passwords is not secure at all and in any eCommerce setting is bad practice. Having the user type passwords twice with good feedback, a la "Passwords Match!" or similar is common, useful and will provide users with the satisfaction of knowing they didn't mistype. –  Tha Riddla May 4 '12 at 15:43
12  
So if I sign you up for an account and you get a e-mail verification link and don't click it, I should be able to spam you with forgotten password emails? Anyway, you need some other form of identification for your forgotten password feature if password isn't the sole method of authentication. By relying on the forgotten password system like that, you're just making the e-mail so important that we'll need to enter that twice instead. –  Janus Troelsen May 4 '12 at 18:20
3  
@JanusTroelsen Plenty of high profile sites manage without entering any details twice - for example ones I'm aware of include twitter, vimeo, gist, kontain, foursquare, digg, freindster, last.fm, stumbleupon, xing, typepad, yousendit, yelp, toggl, tumblr, dropbox, dribbble, bebo, flixster, disqus, harvest, trello, mailchimp, huffduffer, and bang. –  Roger Attrill May 4 '12 at 18:42
35  
@Tha Riddla If users accidentally have CAPS LOCK on, having them type the password twice most likely won't help… –  Ben Hocking May 4 '12 at 21:31
10  
@Dason that's kind of my point. Isn't your credit card number more important to you than your password? If passwords are double required in secret masked fields why does nobody care that the credit card number is entered in free visible text only once? –  JonW May 5 '12 at 1:41
show 8 more comments

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

Like Roger says, ideally you can reset your password easily and securely, but there are certain times that's not an option.

If you're not validating email addresses it's more important that their login credentials are correct; if they lose their password it might be game over if they entered fake email information.

Assuming you have to have a password and you care that it's correct, which seems to be the basis of your question, you have two options:

  1. Don't mask and only ask once. This works great on personal PCs as masking has negative effects as you pointed out. Since PCs are largely personal this can be okay for many uses where privacy isn't a large concern.
  2. Mask, but use a confirmation. This is made necessary because of the potential for typos. For a secure login, the overhead of one field is easily outweighed by addressing the edge-case situations of over-the-shoulder reading.

Trust is an issue if you're not masking. In creating a prototype for an HCI course my team actually used this one password field, no masking approach (without thinking; we just didn't know how to mask passwords in the program). Two of our users (out of 10) were concerned that their passwords did not mask as they entered them. Just the act of seeing your own, unmasked password can be sort of jarring; we're all used to seeing it as a set of filled dots, after all.

Password masking is a convention and a certain amount of people are going to freak out if they don't see it, even if the security benefits aren't real, they are assumed. Definitely keep masking for any sort of secure site or when trust is an issue. I would need some good hard data before I'm comfortable with a no-masking approach on any sign up.

share|improve this answer
4  
I agree that seeing your password in plain text is generally pretty jarring. I did some research to see if I could find any data to support it, but unfortunately most of the plaintext password rage seems to be directed at companies who email you passwords in plaintext. Still, it seems that a few people disagree with Nielsen on this one - the psychological aspects can't be ignored. –  dhmholley May 4 '12 at 15:19
39  
You should never be able to recover your password. You should be able to regain access to your account and reset your password. If your password is stored in a way that it can be recovered, it's not stored securely. One-way hashing should be used to transform the original password into something unintelligible. –  zzzzBov May 4 '12 at 15:25
1  
@BenBrocka: Could this example solve major part of problems? Problems like: asking password once, showing password for avoiding mistakes and hiding password for security. –  webvitaly May 4 '12 at 15:40
1  
@zzzzBov Disagree on the never part. For most use cases one way hashes are the correct option; but when you need to provide application A the ability to automatically connect to application B while masquerading as you your application B password needs to be stored in a reversible form. Configuring one email account to access a second when the latter doesn't offer or has an up charge for forwarding service is probably one of the most common cases for this. –  Dan Neely May 4 '12 at 15:49
2  
@CharlesBoyung, when it comes to security, outliers are just as important if not more important than typical use. If you ignore edge cases as far as security is concerned, then you've left yourself wide open to a wide array of attacks, because attackers certainly won't ignore the edge cases. –  zzzzBov May 5 '12 at 18:03
show 6 more comments

I like the way Microsoft handles this in Windows 8. There is a single password field, and a button that displays the password while it is held down. That way, the user can check for typos. If the user enters their password with great confidence, then there is no need to enter it twice or look at it, but people who want to see if they typed it correctly can, and still don't have to type it twice. Because the button acts like a physical normally open switch, it masks the password on release helps keep the unmasked password from prying eyes.

share|improve this answer
    
I agree this is a good solution: if you're on your own than you can choose to display the password. If you're in an open plan office you can choose to keep it masked. –  PhillipW Sep 6 '12 at 19:44
add comment

The double-entry system for passwords is standard and consistent, so I don't believe there's any significant usability harm in continuing to ask for it twice.

The purpose is simply verification to prevent the user from making more mistakes than necessary.

Masking and unmasking are not ideal options, as there are times when a user could be registering in a public place, or with people observing them.

As anecdotal support: I have had numerous times where I've signed up for an account at a friend's request, or for a particular class. It's much more secure to type my password twice with it hidden, than reveal hunter2 to everyone.

An alternative is to make the password verification an optional part of the sign-up process. The first entry is good enough, the second is there only as a fail-safe for the users convenience.

share|improve this answer
1  
Another thing about double-entry is that it helps the user remember newly created passwords. –  RobC Sep 7 '12 at 17:43
    
I stopped trying to remember passwords. I just auto-generate them and use a password store the keep track of them for me. Luckely, it auto-fills both password fields automatically with the newly generated password :-) –  André Jan 29 '13 at 10:44
add comment

Unmasking the password does not help for some users. If your password is mydogsname, then sure, but what if your password is 0rt(CH8gd!@$8? Some users use motion based passwords (their fingers follow a pattern) in which case they will not be able to easily notice a typo.

Also, some users use pass phrases instead of passwords, and the length of these will once again make it harder to spot a typo.

share|improve this answer
    
It's worth pointing out that these are the only kind of passwords that really afford you a lot of protection. Words in the dictionary and personal information are usually easy enough to crack. Adding a digit at the end or l33ting it is usually only a little better. –  rbwhitaker May 4 '12 at 22:02
3  
@rbwhitaker: No, such passwords are terrible because no one can remember them. A random 4 word sequence is as secure as 8 purely random characters, and easier to remember. –  user9739 May 5 '12 at 8:55
    
@JoeWreschnig: What you're saying is true. If you can't remember them, or if you have the "PC Sunflower" (with sticky notes of all of your passwords stuck around the edges of your monitor), you have a different set of problems, but they're not very vulnerable to brute force guessing attacks. I, for one, am able to memorize these random passwords just fine. But Dean mentions pass phrases too, which as you, yourself, said, can be pretty effective. I was referring to both of these types of passwords. Either one is much more secure than more "traditional" passwords. –  rbwhitaker May 6 '12 at 1:26
3  
One technique that never gets a lot of attention is password algorithms. You don't have to remember anything, since you generate a password based on something specific to what you need the password for. Every site you go to you just need to follow the steps you made up, and you'll get a unique password (most of the time). –  Dean May 6 '12 at 4:05
1  
I mostly use completely randomized passwords, and what Dean says is true. I don’t know what a single password of mine looks like. It’s just a sequence of key strokes, done by muscle memory. If I need to remember a password exactly, I have to imagine a keyboard to be able to know it. –  poke May 10 '12 at 19:06
show 1 more comment

As Ben said, some users will be disturbed by unmasked passwords, for good reasons.

You could offer a toggle, but that won't really help users in this class. They'll know you intended for them to see their password (not a bug), but that doesn't provide reassurance.

In addition, if using the toggle control interrupts the flow of filling out the form, you have introduced a barrier instead of making it simpler. (Type password) - tab - (type password) is easy and common; is your flow as easy as that?

Another approach: I've never seen this on a desktop machine, but I have noticed that when typing passwords on my phone the device displays only the current symbol, masking the previous ones. I assume this is because of the high rate of inaccuracy on phone keyboards compared to physical ones. Perhaps you might look to see if anybody has explored that kind of interface on a desktop machine as an alternative to the double-entry. (But there will still be some user astonishment there; the first time I typed the first letter of a password on my phone I was certainly surprised.)

share|improve this answer
1  
Why the downvote? –  Monica Cellio Jun 12 '12 at 21:09
    
In addition, if using the toggle control interrupts the flow of filling out the form, you have introduced a barrier instead of making it simpler. (Type password) - tab - (type password) is easy and common; is your flow as easy as that? That's easy to prevent. Use tabindex in your input-elements. –  Victor Bjelkholm Aug 31 '12 at 19:40
    
@VictorBjelkholm, that's one way to address it. Another it to put the toggle checkbox above the password inputs. The implemenation has to consider this aspect of the UX and we can't take that as a given, unfortunately. I still think it's a bad idea for the other reasons given here. –  Monica Cellio Aug 31 '12 at 20:02
    
well, the checkbox would also need to use tabindex or else the username -> tab -> password flow is ruined. –  Victor Bjelkholm Aug 31 '12 at 20:29
add comment

Mistake while typing the password is the best reason why websites ask to confirm password and in most websites/forms, the second password type validates that both the txt matched and flashes an error if they don't match.

Read through the link you have mentioned but still toggling the visibility of password is still a security issue and users shouldn't be given an option.

share|improve this answer
1  
"the second password type validates that both the txt matched" - if user switched to french language keyboard accidentally but he wanted to type the password with english letters. So user thinks he is in English but he typed twice french letters. Both "french" passwords match each other and registration was successful but user remember the "english" password. So user cannot login because he cannot enter his "english" password because it is saved as "french". The best solution for this is to give option to show the password and there is no need to ask the password twice. –  webvitaly May 4 '12 at 14:42
3  
Agree. I have faced this problem where CAPS LOCK was on for some reason and I just couldn't login later. Retrieve password made me realize the mistake - though I believe we shouldn't have retrive password option at all. It should always be recreate new password. –  Chandra Mohan May 4 '12 at 14:45
2  
@ChandraMohan: that's why many login dialogs now display messages about caps lock, either immediatly, or upon a login failure. –  Marjan Venema May 5 '12 at 9:03
add comment

Windows Phone 7 has an interesting solution to this problem. Typos are so common with the on-screen keyboards that it makes a lot of sense that they spent the extra effort here.

You'll see the last character you typed into the password field for 2 seconds before it turns into a *. I pretty much duplicated this functionality with some JavaScript just now... http://jsfiddle.net/SWortham/rQJaP/13/embedded/result/

Someone looking over your shoulder would really have to have their eyes glued to the screen as you're typing to decipher your password. And yet, for those paying attention to the screen as they type, it'll help prevent the stupid mistakes like having CAPS LOCK on, or simply hitting the wrong key.

(There are some bugs with this when it comes to selecting and deleting the password. With a little more time these things could probably be worked out.)

share|improve this answer
    
Pretty good solution of the problem. But I think this example - jsfiddle.net/webvitaly/Jdtke/embedded/result could solve major part of problems better. Problems like: asking password once, showing password for avoiding mistakes and hiding password for security. –  webvitaly May 13 '12 at 18:35
1  
Android and iOS do this as well. It's helpful but not perfect for long passwords; if you type fast it's easy to miss one or more characters. –  Ben Brocka May 13 '12 at 19:18
    
@webvitaly - Yeah, I liked that approach as well. I can definitely see pros and cons of each. –  Steve Wortham May 13 '12 at 19:46
    
@BenBrocka - I agree, if you're typing fast it's hard to see every letter as you type it. But I do like how it solves certain problems without requiring the user to read and follow additional instructions, or toggle any options. –  Steve Wortham May 13 '12 at 19:48
    
Showing characters for 2 seconds is good but think ability to view all characters at once is still very useful if you want to verify the whole password or if you are trying to fix one char in the password. Seeing the last character doesn't help when fixing a password. –  Anna Rouben Jun 11 '12 at 18:46
add comment

Imagine situation like this.

Ordinary user who uses same password for each website (very simple one like 1980) accidentally clicks on show password button. His buddy sees that and logged in to Facebook and posted under his name. User will blame your website and told everyone that it is stupid and useless website. And how you know, one unsatisfied customer is equal to 20 satisfied customers but in a bad way.

share|improve this answer
    
I'm not sure what this means regarding asking the password twice though. This situation would still happen if you asked for the password once or twice - if someone sees your password being typed in then it doesn't matter how many times you want people to type it in because if they know the password is 1980 then they'll type that in both boxes. –  JonW Mar 17 '13 at 18:02
    
But in a ordinary case user types password in password box. How can other person see your password. My example was about show/hide button. I want to say that it is not a good idea. –  TIKSN Mar 17 '13 at 18:53
    
@TIKSN How often user is registering sitting near his friend? Even if such situation happens user will see after first letter that password is unmasked and will hit the button for mask his password. But even if there are no such button user at least could hide password on the screen with the hand while typing for mask it manually :) –  webvitaly Mar 18 '13 at 9:10
    
Will you hide password with your hand? I would not. You have to require as less as possible from user. –  TIKSN Dec 22 '13 at 17:38
add comment

you must not ask password at all: generate it automatically and send in welcome email.

  1. its easier for user to start
  2. its more secure

UPD

Why its easier to start.
Here is a worflow of my latest app:

  1. User come to site and open registration form. The only thing we ask is email address.
  2. When email is entered, we send autogenerated password like "fown7ucvd" on email and imideatly autologin user into his account and remembers him (cookies sliding expiration) for 20 days.

As the result:

  1. expremly easy to start
  2. user does'nt have to know at all that "there was a autogenerated password", his just start to explore my app.
  3. user does'nt have to enter any of his favorite password (ussualy one or two) also user does'nt have to enter 12345 in a password field. BTW this is why its most popular password -users are not dum, they just wanted to look at your service without entering a lot of personal data.

Why more sucure: The point about security is when you have one password for all resources, if password gets compromised, ALL data is in danger. So in general its more secure to autogenerate password.

share|improve this answer
2  
1) are you sure that with this "dfi&!ue.jx#%$h@!$df" it is easier to start than with this "chup@dora321" for example? :) 2) "chup@dora321" has almost same level of security that auto generated "dfi&!ue.jx#%$h@!$df". But it is impossible to remember this "dfi&!ue.jx#%$h@!$df" and it is bad UX. –  webvitaly May 11 '12 at 10:04
    
Here is a worflow of my latest app: 1. User come to site and open registration form. The only thing we ask is email address. 2. When email is entered, we send autogenerated password like "fown7ucvd" on email and imideatly autologin user into his account and remember him (cookies sliding expiration) for 20 days. The point about security is when you have one password for all resources, if password gets compromised, ALL data is in danger. So in general its more secure to autogenerate passwords. –  ADOConnection May 13 '12 at 9:29
    
This is fine but at some point a returning user may like to change their password to something they'll remember. And then we face the same problem for the change password dialog. Do we force the user to type their new password twice, or just once? –  Steve Wortham May 13 '12 at 20:03
1  
Email is not a secure storage for passwords. It adds all the intermediates between the email server and the email provider into the chain of trust for your site. And what about the password to access the email account itself? –  Eric Bréchemier Sep 7 '12 at 10:02
1  
@ADOConnection - I have experienced this pattern first hand, and this gave me a bad feeling about the web site, leading me to wonder: if they think it is OK to send a password in plain text, are they also storing it in plain text in their database? And in one case, I was not even able to change the password, keeping the generated password was the only possibility. –  Eric Bréchemier Sep 7 '12 at 11:20
show 5 more comments

From what I have seen through multiple usability studies, the biggest issues is that users don't pay too much attention when signing up. The risk is that if users mistype their email address, they won't be able to recover their account, regardless of how well the password recovery module works.

Asking twice (or validating the email/username in whatever way) is far more important.

share|improve this answer
    
I agree that the email is the most important part of user registration. But this is the theme for other topic. And the main idea of this thread is about masking or unmasking the password. –  webvitaly Jan 29 '13 at 14:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.