Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I currently have a page dedicated to changing passwords. There are 2 options:

  • A 2 step option:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

mockup

download bmml source

  • A 1 step option:

mockup

download bmml source

I feel that the 2 step option feels more "secure", although it performs the same thing as the 1 step option. On the other hand, the 1 step option feels quicker to complete.

Which option is better from the UX point of view? Are there any other implications I have not considered?

share|improve this question
    
Perhaps you can do away with the Confirm Password box as well, at least if you are offering a service to reset the password already. –  André Oct 1 '12 at 13:52
    
Technically speaking, the one-step process is actually more secure than the two-step process. The two-step process (if each step is a separate server request) requires that a session be created or updated with authenticated permissions after the first step. This is open to session hijacking. Of course, it's highly unlikely, but in a one-step process, it's impossible. In terms of which is more secure, it's the option with no possibility over the option with slim possibility. –  Koviko Oct 19 '12 at 20:06

5 Answers 5

up vote 29 down vote accepted

Cutting it down to a single step makes the process simpler and better fits existing conventions, so it's probably superior from a UX perspective. Each additional step you introduce is more work for the user. Add in the potential for users waiting between page loads (especially on mobile) and you're really just adding an additional inconvenient step in their way on what could be a relatively pain-free process.

I'm not sure that the two step process is any more secure. Authentication is still required to change passwords, so there's no material change in the security involved. Maybe there's an argument to suggest that it's perceived to be more secure, but it's not one I'd buy without seeing evidence from users that they believe so.

share|improve this answer
1  
+1 Minimizing page loads (esp on mobile) is always a good thing as long as it doesn't clutter the page. Go for a single step process wherever possible. –  StarNamer Sep 28 '12 at 13:00

You should use 1 step with only two fields.

Unmask the password field and you will not need the last password confirmation field and users will make less errors while typing password. You may use this approach with password toggle visibility. Also you may read "Stop masking the password by Jacob Nilsen".

share|improve this answer

I would require them to login first before they can make any account changes. This is for security reasons...I don't want to give an un-authenticated user too many rights to make changes in an app.

As for changing a password, I make them type the current password, and confirm the new one. I require them to confirm it so they don't mistype the password, if the passwords are equal, then I update it, if they aren't I throw an error back to the user.

To make other account changes (name, address) I still require them to type their current password. This is for security purposes. True they are probably already authenticated, but if someone hijacked their session, maybe they forgot to logout on a public computer, that person wouldn't be able to change their password and email.

If they forget their password, I let them enter username or email and they get sent a password reset link, which emails them a new temporary password. The reason for this is that they have to have access to the user's email to reset the password.

share|improve this answer
4  
You've not really answered the OPs question about whether it should be done over two steps, or just one. "As for changing a password, I make them type the current password, and confirm the new one.. Do you do this over 2 pages, or just one? –  JonW Sep 28 '12 at 9:09
    
Just one page, 3 fields (current, new, new_confirm). –  chovy Sep 28 '12 at 18:36
    
Ok, that's a bit closer to an answer, but you've still not said why that is your suggestion. Can you expand you answer so you can provide some detail and reasoning? –  JonW Sep 28 '12 at 20:21
    
added some more explanation. –  chovy Sep 28 '12 at 21:10

1 step, definitely. Several successive forms should be reserved for cases where there's a large amount of data to be shown/asked, and the different forms may categorize this, so that the user always keeps the overview.

With just three fields to fill out there's little risk she's going to be overwhelmed by the amount of data. A plus of a single form is that you know where it ends. Especially questionnaires on the web are good at this. "only 5 minutes of your time", and you can prepare for clicking next a gazillion times. Some designers think it helps if they show the progress: "you're on page 1 of 15".

Anyway, having both old and new password on the same form will not be confusing IMO. "What do they want from me here? Ah, not the new password, because that's the next line". All in all, for low amounts of data entry fields it's a good idea to show them all together.

Just don't mess up the layout: keep fields aligned as much as possible, even if one field would become a bit wider then (won't be the case here). Which doesn't mean that you want a 15 cm wide field for a ZIP code, I said a bit.

share|improve this answer

Workflow-wise, 1 step is a no-brainer. It's three fields and there's no reason to separate them. You can also nicely inline validate all 3 fields at once; what if my passwords don't match on the second screen in 2 step? Is my old password still valid? If not, that's a pain in the butt. If so, that's a potential security risk!

Actually a two step seems significantly less secure; suddenly you've got a new-password prompt independent of an old password verification. Sure, you entered it on the last page, but damn, that's scary. What if I click back and that form still works because of resubmitting form data? What if I walk away from the PC after step 1? Suddenly you, the app owner, have more security considerations like temporarily authenticating this one form and not accepting resubmissions of the old-password-only form.

Definitely go with one step. The three field Old password, New Password, Repeat password form is a convention to boot. Two steps is just asking for trouble security and usability-wise.

share|improve this answer
5  
+1 two step can be significantly less secure. –  Markus von Broady Sep 28 '12 at 15:02
    
I haven't thought about the security implications, thanks for that :) –  F21 Sep 30 '12 at 2:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.