Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

We login to applications almost every day. The password is stored in our fingers, as an automated process (if they have used it long enough). When users realize they have entered a wrong character (before hitting login-button) they erase the whole password, and retype the entire password – instead of just the last wrong character. Question is why?

mockup

download bmml source – Wireframes created with Balsamiq Mockups

share|improve this question
2  
Perhaps this could lead to a new UI pattern for deleting the entire password when the user presses the delete key once? As it stands now it would be disorientating, but as a pattern we could get use to, it could prove useful. –  Matt Sep 26 '12 at 16:35
    
Some systems will lock you out (or force a timeout) after a certain number of failed login attempts. (Usually erasing your password and starting over does not count as a failed attempt.) Logically this would be an influence on user behavior, but in practice I am not sure. –  emory Sep 27 '12 at 5:08
    
I have to log into a lot of different server panels with all different passwords, so if I need to check if I typed some stupidly hard admin password in correctly on the web, I right click the password field in Chrome and change the input type from "Password" to text so I can be sure and don't have to retype it. –  MobyD Sep 28 '12 at 14:32
    
if i have a fat-fingered moment, i am never sure if i pushed 0, 1, 2, 3, even 4 keys at once, it's hard to count those little stars when there's ten of them –  Toni Leigh Apr 14 at 20:37

6 Answers 6

up vote 38 down vote accepted

I would say that it is due to two reasons.

The first one you mention yourself, it's an automated process. It's easier to perform an automated process from the beginning to the end rather than breaking in somewhere in the middle and trying to complete it. In other words, it may take a user less time to write the entire password than the last third of it, because that's not a muscle pattern in the same way as the entire password is, the cognitive load for that task is increased immensely.

The other reason I would say is in the masking of the password. When the user realizes that she probably slipped on the keyboard and stops writing, she stops in the automated process. It's hard to backtrack in an automated process where it went wrong. Did she stop right after the typo, or did she write a character after the typo? Looking at the masked text will not say much.

Issues like these simply makes it easier to rewrite the entire password rather than trying to mend a broken one.

share|improve this answer
1  
While I pretty much agree with you - I don't believe that you can easily recall partial muscle-memory in this way, I'd love to see some actual academic research articles on this. It strikes me that there must have been studies done into this. (Imagine a musician who knows his piano piece off by heart then being asked "right, now start playing from bar 2 instead") It might be one of those 'it's obvious so research will just support this hypothesis' statements, but that potentially might not be the case. –  JonW Sep 26 '12 at 13:10
    
@JonW A musician will most definitely have to concentrate more when playing a piece, otherwise known by heart, in a new way. I believe that was what you meant also (sorry, my English fails me sometimes..). But in either case, the musician may be inspired by the challenge, maybe get a chance to explore new areas in their musical repertoire. This however is hard to transfer to someone trying to authenticate themselves in a login form. That user doesn't want to test or try anything, like writing the password in a new manner, they just want to log in, and as quickly as possible at that! =) –  AndroidHustle Sep 26 '12 at 13:22
    
That's not really what I was getting at. I was suggesting that if a musician knows a piece of music due to their muscle-memory in the same way as people know their passwords then it'll (hypothetically) be harder for them to start playing mid-way through the piece rather than at the start. Same as with people starting their passwords from the start instead of part-way through. –  JonW Sep 26 '12 at 13:36
    
@JonW Yes, exactly! That was what I was trying to say in my third sentence in my answer.... –  AndroidHustle Sep 26 '12 at 13:41
    
@JonW - I don't know of research on muscle memory, but I do know the thinking is that repeated actions get deferred from the prefrontal cortex to lower-level brain processes. I will try and get some references and post them. –  Jimmy Breck-McKye Sep 26 '12 at 14:10

Because they can't see the password to know if it's only one error. Knowing there is at least one error, it makes sense that there might be more (for example, the classic "fingers strayed from the home row" scenario).

Furthermore, there's a large amount of kinetic memorization involved in typing, particularly something like passwords where there's no visual feedback. With kinetic memory, it can be easier to start from the top and follow the prescribed set of motions than it is to stop in the middle and resume. It's similar to rote memory in that way: do you know anyone who can't tell you the last four digits of their phone number without running through the first part, or who has to run down the list of letters to figure out what letter comes immediately before a given letter (example: "What letter comes before 'R'?" "Uh... LMNOPQR Q.")

share|improve this answer
1  
+1 for "kinetic memorization". Nice phrase. –  Matt Sep 26 '12 at 16:33

Three reasons.:

  1. A user might not actually know which character they got wrong. If they touch type, all they know is that the movement of their fingers over the keys went awry. The entry of the keys is semi-automated so they might not be aware where in the word the error was.
  2. As AndroidHustle suggests, entering the password is a semi-automated finger action that is easier to do start to finish than from an arbitrary mid-point. So the re-entry requires password deletion.
  3. A user may not know if they entered more or less characters than usual. It's hard to count character lengths even with 'real' text - with tiny asterisks, even more so.
share|improve this answer
3  
Your point 1 is the reason I usually do this. I feel my fingers slipping on the keys, or press two keys simultaneously when I intend to press only one. At that point, I do not know what error I made, so my best bet is to go back to the beginning and start again. –  TRiG Sep 26 '12 at 18:18
    
Agreed. Easier to begin again than count with a long password. Also not sure if my slip made me enter "tr" or "rt" so I can't just delete the last character. I could delete 2 characters and continue, but even then, it's easier to hit Ctrl+A and just begin again. –  xiaohouzi79 Sep 27 '12 at 0:27
1  
I think there is a 4th reason: people know that most of the times they only get 3 chances to enter the password correctly. They want to make sure that those 3 chances are spent well. –  Bart Gijssens Sep 28 '12 at 8:18

I can't speak for others, but I know why I do it: it's because, if my fingers slip while typing, what usually happens is that I end up hitting the side of a key, or a spot between two keys, or hitting the key only weakly, rather than hitting the intended key solidly right in the middle as I meant to.

Now, depending on exactly how hard and at what angle my finger happens to hit that spot, it might result in two, one or no characters being entered. And, unless that happens right near the beginning of the password, I'm not going to start counting all the "•"s to find out which one of those cases happened — it's much easier to just erase the password and retype it.

(Possibly relevant background info: I don't touch-type, although my two-fingers-plus typing style is reasonably fast. Also, my passwords tend to be fairly long, from 12 to 30 characters — I know enough about computer security to know that, with passwords, one can have at most two out of "short", "secure" and "memorable", and I prefer to pick the last two.)

share|improve this answer

I think that in some cases the password is deleted as a whole because it's selected (usually shown as inverted white text on blue background).
It gets selected when the user leaves the field and returns to it, especially when doing so with the keyboard (shift + tab).
Clicking the mouse near the text should un-select it and then it can be edited.

share|improve this answer
1  
The question is about user behaviour, trying to find why as a user writes a password and puts in a typo they usually erase the entire password when it's probably just the last character that needs changing. It has nothing to do with input control behaviour. –  AndroidHustle Sep 26 '12 at 14:03

There's a theory that typing is actually a two separate processes working together, where one loop puts in keys, and the other is trying to detect typos. (You ever notice how when you make a typo, you have to pause before you can correct it?)

I think this behavior makes a whole lot more sense with this theory, as it explains both the reasons in AndroidHustle's answer:

  • It's an automated (opaque) process because the typo-detection process can't directly influence the typing process, just interrupt it.
  • Since typos are detected by a separate process, users are used to being able to look at the screen to figure out what to do/how to fix it. Since the password is masked, they would need the skill of remembering which keystrokes they put in most recently, which is probably rarely used in practice (as you'd just look up at the screen, instead).
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.