Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

How should feedback be given about password rules in registration forms?

a) When you focus on the password field

b) When you type the first letter of the password

c) When you stop typing, plus a small delay

d) When you tab away from the password field or click [Register], if the password does not meet the requirements.

share|improve this question
6  
e) don't have password rules and let the user enter whatever they like... ? –  JonW Aug 20 '13 at 16:30
    
Are we there now? If the user wants "123" as his password, we let him? –  forthrin Aug 20 '13 at 18:22
    
Well we could be, but that's not exactly what I'm saying. I'm just suggesting that your a-d aren't your only options. From a pure UX point of view then shouldn't allowing your users to use whatever they want as a password something worth considering? –  JonW Aug 20 '13 at 19:06
1  
@forthrin Yes, if the user wants "123", let them. It's their account they leave basically open for everyone, not yours. It's just like your landlord cannot really force you to actually lock your door, though you usually do –  Tobias Kienzler Aug 21 '13 at 8:13
3  
I would let them use "123" but give them feedback as to why it's bad/good, eg "This password looks easy to guess" or "Great password very strong" –  bendataclear Aug 21 '13 at 10:31
show 7 more comments

6 Answers

When to display invalid password input?

In the case of password fields, research strongly suggests that as-you-type (with short delay) is the way to go. Luke Wroblewski has shared great experiment results answering your very question; Smashing Magazine has also got a good article on this.

                  A form showing inline validation

Where to display the password rules?

  • Always - increases cognitive load. The password rules are only relevant to the user when they type their password. (You can derive at this by means of design over-dissection - if the form would turn a wizard, where would you put the rules?).
  • On Focus - Optimal option.
  • On Blur - This may be a tempting option since users may enter a valid password, so why bother them with rules? But if there is an expected behaviour from users you should inform them beforehand rather than telling them off afterwards. The cash point example below exemplify this:

                               A wireframes of two different cash points.

share|improve this answer
    
The second blue one reminds me of Out of Cream!... or Computer says no... –  Tobias Kienzler Aug 22 '13 at 6:26
add comment

First I have to say is try and avoid them as people tend to reuse passwords and unique password rules make it easier to forget. Having said that, I myself had to bow down to those rules, so I understand it's not possible always.

In terms of displaying, you want the user to remain in control, so you want her to stay informed before typing in a password. This would allow the user to decide on a password and them take action on it (focus on the field, and type).So I think it should be visible all the time and not on focus or later.

You could do a highlight on the rules on focus, to help ensure that the user has not missed them, or forgotten them.

share|improve this answer
1  
+1 for "you want the user to remain in control" –  Don Nickel Aug 20 '13 at 17:05
    
Users are so educated on passwords these days that there's no point in enforcing rules? –  forthrin Aug 20 '13 at 18:23
1  
I agree, if there are rules, be open about them. Visual clutter etc. are a different problem that can be solved in many ways. Hiding the fact that there are rules is not the way to go about it. –  Koen Lageveen Aug 21 '13 at 9:14
add comment

While your question ask on how to display password rules, I would instead like to argue why not to enforce any password rules at all, and why they are bad ux. I'm strongly resisting the urge to inline the obvious XKCD comic here, instead concentrating on points already made in the very related question on security.SE, Is it safe to show users why their password is not allowed?, and I'd like quote from both Tom Leek's accepted answer and mine:

[Tom Leek] In any case, "password requirements" are counter-productive and decrease security, save for a "minimum length" which can be rationally justified. So just don't do that. Key to password security is user education, possibly helped with some tools (e.g. a random generator for strong passwords).

[me] I recommend not forcing users to choose an arbitrarily complex password that they will simply end up writing down on a post-it next to their monitor (or having them reset their password as simplified "login"). Instead, let them know that their password is weak, tell them what a good yet memorable password is (e.g. use a pass- phrase instead) and allow them to proceed anyway after clicking a "Yeah, I understood my password is not very secure, let me proceed anyway" - it's their fault if the account gets hacked then and you should not be liable after this explicit warning. Assuming you did use a proper and established password hashing instead of homebrew-crap or, worse, plaintext.

So in summary, instead of displaying some arbitrary password "rules" anywhere, please simply provide a link "How to choose a good passphrase?" (phrase, not word!) and add a "password/phrase strength indicator" next to the field. Allow even something as moronic as "123" or "password" but make it clear that you don't take any responsibility for the user's not using something more secure.

And finally, take care you store the password/phrase securely and never as plaintext! See also here

share|improve this answer
    
Excellent points! Inform, but not enforce. Now, where is everyone's favorite JavaScript passphrase strength calculator that I can borrow? –  forthrin Aug 21 '13 at 11:17
    
Glad to hear you agree :) StackOverflow to the help: stackoverflow.com/q/948172/321973, and webtecker.com/2008/03/26/…. Here's a nice read (on a quick glance at least): tech.dropbox.com/2012/04/… linking to github.com/lowe/zxcvbn - that latter one looks quite informative: dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html –  Tobias Kienzler Aug 21 '13 at 11:19
    
(though the latter is a bit too verbose for my taste - I would instinctively distrust a website that shows my password in cleartext) –  Tobias Kienzler Aug 21 '13 at 11:28
    
While zxcvbn seems brilliant: 680K for this? Is there a small one that does not use a framework and still does a great job? –  forthrin Aug 21 '13 at 11:32
    
That certainly depends on the complexity you want - a small checker will simply not be as sophisticated, but then again it's probably not your responsibility to give a precise estimate, so a simple entropy-meter might suffice –  Tobias Kienzler Aug 21 '13 at 11:51
show 3 more comments

I like the following pattern.

There are couple benefits. Firstly you show what the password is expected to contain "the rules" so the user has a clear expectation of how they need to pick/formulate the password.

The second benefit is that you prepare and reflect back to the user when they have achieved the "criteria". The instant feedback avoid the whole submit - error - retype cycle.

Inline password validation

If you use a confirm password input as well this cycle can be increased as the user (nor the system) knows which password was entered incorrectly so they have to type both again - Slightly off topic this paragraph though.

share|improve this answer
add comment

The syntactical rules that govern passwords should be displayed always (or whenever it's possible to set the password), preferably right next to the password entry field(s).

Violations of the syntax should be indicated as soon as possible. Sometimes this means when the offending character is typed, but also consider the initial state violations. If a numerical digit is required, the initial state of the password field (empty state) will be in violation of this and this should be indicated. When the violation is addressed (they type in a number) this should be indicated (possible by graying out or crossing out the violation notice).

Rule of thumb: the user should know whether or not the password is acceptable as soon as possible.

share|improve this answer
add comment

I think it's fair to refer to the other answers for the question, but I would like to add the following:

If you have password rules then also present them on login as well as register.

This way any of the massive number of users who prepend a 1 or a ! to the end of their commonly used simple password will have a useful reminder.

Many users just repeatedly use a common dictionary password. If they've been pushed off this track by complex password rules then they might not remember your site has complex rules in the first place, reminding them will help them to think of what they might have entered, i.e. did they use the complex password they use repeatedly when they need to, or their common password with a special character prefix, etc.

So aside from presenting the password rules on register which is not a commonly used password related page the rules should also be displayed on the login page which will be used much more often.

Something along the lines of 'for security reasons we required you use a password with one special character' near the password field.

This suggestion is based on three pieces of provable evidence ...

  1. that users choose poor passwords en masse.
  2. that users re-use the same password for many things
  3. that users often have poor memories for things like passwords, especially when a long time lapses between usages and with visual memory removed through password obfuscation.

... and then on the deduction that a user who chooses a dictionary password is not suddenly going to choose a random string of 15 keyboard characters just because a special char is required. Therefore there's a good chance you could jog their memory. It would be an interesting test, though I can find no such test online.

share|improve this answer
    
Not really "rules" if it's only a recommendation shown when you log in. –  Mike Mersereau Feb 7 at 13:04
    
the question is clearly about presenting password rules, not about what the rules are or should be, so I recommend they are presented on login for better usability –  ColinSharpe Feb 7 at 13:18
    
And, even though I say so myself, it's a very good suggestion, relevant to the question ! –  ColinSharpe Feb 7 at 13:52
    
Can you elaborate on why it should be displayed on log in? Do you mean before you log in, or on the form? The user should already know their password when visiting a site, no? –  Mike Mersereau Feb 7 at 14:19
1  
If I go to log into a website and I don't know my password, a tool-tip telling me "your password must be 8 characters, and contain 2 special characters" won't make me remember what I chose. –  Mike Mersereau Feb 7 at 14:21
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.