Tell me more ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.
up vote 16 down vote favorite
2

Is it a good idea to have an unmask checkbox for user selection when the users type their password to show them what they typed?

share|improve this question

3 Answers

up vote 12 down vote accepted

Yes, having such a password can be an accessibility aid for people with mobility issues. Just be sure you don't name it "unmask." Use user-friendly vocabulary like "Show my password."

On mobile, the consensus seems to be that this checkbox should default to display the password unmasked.

On desktop, it's probably better to default to hide the password in keeping with convention, although it's notable that usability expert Jacob Nielsen advocates for unmasking all passwords by default because masked passwords makes users feel less confident, which

  1. leads to lost business.
  2. negatively impacts security because users choose shorter passwords or copy and paste passwords from their computer.

Nielsen also notes that if someone really wants to know your password, they can just look at your keyboard instead of your screen, which means that on-screen masking could give a false sense of security.

share|improve this answer
Very much agree with everything except "asked passwords makes users feel less confident". Unmasked passwords make me (and i would think many) feel less confident, because to me it says "you do not handle passwords in standard ways, following password security" Also on the web a masked password fields are also treated with more security on the browser. – Andrey Mar 15 at 21:27
1  
I would suggest on mobile, the default should be to mask the password, but show the last-typed character unmasked, as in ******j. – chaiguy Mar 21 at 20:27
up vote 3 down vote

Yes, theoretically it's better from a UX perspective. But in general it's worse, as it can lead to security issues. An unmasked password field may let others see it when peeking from behind the user's back.

It is actually balancing between security and UX, as the last paragraph of this article says: http://uxdesign.smashingmagazine.com/2012/10/26/password-masking-hurt-signup-form/

Passwords are sensitive information and they should remain masked. My recommendation is not to let users do it. Or, if a compromise is needed between UX and security: hiding the password with a delay, e.g. the last character typed could be replaced with a mask after one second.

share|improve this answer
1  
I'd love to know what proportion of passwords are entered in an environment where someone else could see the screen. My guess is it's a big usability hurdle which is completely irrelevant most of the time. – Steve Bennett Mar 19 at 23:07
That's true. However, security is a "higher value" and it should remain kept at decent level. You are right that these situations cannot be very common, but still - possible, and easily imaginable for the user. Having the password field unmasked can lead to a feeling of an insecure system the user is accessing. In the same time, spotting the password from observing the keyboard is almost impossible for most people, and displaying it in unmasked form would let anyone who could look from behind know it. It is the contrast of difficulty between these that makes difference. – Dominik Oslizlo Mar 19 at 23:17
Interesting though that the default on mobile is clear text, or "hide after a few seconds". You'd think mobile users would be more likely to be entering passwords in view of other people - public transport etc. – Steve Bennett Mar 19 at 23:57
Although the likeliness is higher, indeed, the mobile screens are smaller and it's harder to spot a text on them. However I am not sure if it is intended. Even hiding each character after some delay is good as to spot a password in this case would need the 'watcher' to see all the process of entering it. If the password remains unmasked, and there are conditions good enough to see the screen from really close distance, it would be too easy to read the password in a second, especially if it's a common word. – Dominik Oslizlo Mar 20 at 0:13
But anyway - it's a matter of tweaking, and finding balance between UX and security. There is simply no single answer for this question that would apply to all the situations. But from my perspective, the UX profit is not enough to decrease the security. – Dominik Oslizlo Mar 20 at 0:15
show 2 more comments
up vote 3 down vote

The answer depends on your application, of course. But if you have to opportunity to study your users in this regard, do it. That data will be much more useful than general recommendations.

If you can't perform any studies, there's always the general recommendations. Nielson thinks we should stop masking passwords. This report contains some good data and very helpful observations, though some of the assertions are over-generalized and logically problematic.

And as always, you should evaluate any generalized recommendations against the specific context of your application.

Questions to ask yourself:

  1. What are your users' expectations regarding passwords and security?
  2. How secure does your application need to be?
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.