User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a question that has been bothering me some time, let me illustrate my question with an example:

  • I use multiple passwords in many applications and sometimes I forget what is the password for some site.
  • At this point, I do what anyone will do in my situation, try again, and when nothing else comes to mind, reset my password.
  • Multiple times I've come to find that the password requirements of the current site is different from the common ones (for example, a-z A-Z 0-9 _? and 8 length) and when I input a password that matches the requirements, I come to find that was my original password all along.

If the site had told me the password requirements I might have remembered correctly my password

So my question is, Why does no one ever show these requirements?
Is there any reason for these?

Edit1: I still don't see why showing the password requirements will be a security issue if the page I'm accessing has public registry on and I can see the requirements once I try to create an account

Edit2: yes, this question is a duplicate, It was originally posted in and I didnt find a similar question

share|improve this question

migrated from Feb 14 '14 at 9:55

This question came from our site for professional programmers interested in conceptual questions about software development.

marked as duplicate by Mervin Johnsingh, JonW Feb 14 '14 at 12:34

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

This question came from our site for professional programmers interested in conceptual questions about software development. – RdPC Feb 14 '14 at 9:59
So what is a conceptual question? What is the reason isn't good enough and is off-topic? :p – RdPC Feb 14 '14 at 10:00
I'd consider it a security question rather than a user interface of programming problem. See my answer as to why. – jwenting Feb 14 '14 at 10:03
To answer your edits: The potential security issue, when you make password rules public, is that you narrow down the options for hackers, who can fine-tune their algorithms by only testing valid password strings. However, this can be compensated by using longer passwords/pass phrases. – Benny Skogberg Feb 14 '14 at 14:32
But aren't the password requirements already public when you allow users to create their accounts? In a web where the registration is public for everyone, a hacker can just try to create an account and look at the password requirements there. I agree that it will be a security issue in webpages where users aren't allowed to create accounts themselves – RdPC Feb 14 '14 at 15:25

From a Security perspective – No. From a User Experience perspective – Yes. That’s often the problem when different goals meet in the middle, which one is most important. As this is the site of User Experience, the popular answer is to show users what the rules are. That is fine as long as your security requirements are met. They don’t have to be UPPER CASE, $ym8ols or numbers. Passwords can be strong if they are long enough. In addition, both of your goals have been met making the accounts secure and useful.

enter image description here

share|improve this answer
That is brilliant. And your answer highlights an interesting point, %ymbols aren't as good passwords as a string of normal words "this is fun"… – tim.baker Feb 14 '14 at 11:21
correct horse battery staple – user43037 Feb 14 '14 at 12:21
@BennySkogberg you copied and pasted the same answer on the other question (this is a possible duplicate of that one) and again it's not clear on the UX aspect. You actually talked more about the security side. How is showing password requirements bad for UX? – eric Jun 16 at 3:16

you should not show a message reading "incorrect password" as it gives a potential intruder knowledge that the username entered was correct.
Rather give "invalid username or password", leaving them to wonder if either or both are wrong.
Password requirements similarly should not be listed on the login page, only on the page where passwords can be set/changed. Again, a potential intruder can use those requirements to refine his algorithms for password generation.

share|improve this answer
Yes, well, I'm not saying that it only says "incorrect password", but -> "invalid username or password and the password is 8 chars and numbers", and I'm talking about common websites where anyone can create an account and the password requirements are public to anyone when they create new accounts – RdPC Feb 14 '14 at 10:13
@RdPC in that case, why not also list the requirements for "username" ? – Carl Witthoft Feb 14 '14 at 13:02
Yes, that will be a good idea too – RdPC Feb 14 '14 at 15:17

Yes this is a very good idea.

As of now I have no proof through academic study or anything along those lines, however, a bit of logical deduction can help show that you will probably help a lot of people by doing this.

Some provable points:

  1. Users have poor memories for passwords, especially if they use your site infrequently and the password fields are permanently obscured (there's a good argument to allow plaintext viewing of password fields that you should consider, but that's not really releavnt here).

  2. Users repeatedly use the same password for lots of different accounts. This is often a short, memorable string, loved ones name, name of a pet etc. They will pick something that is easy to remember then use it again and again because they are more interested in using the service than being forced to think about security. There are numerous surveys on this.

  3. If you get repeat visitors then your register page will be used once and your login page manu times per user.

This list of passwords is a great example: - these typical users are helping their memories, require a special char and you're going to get !'s and ?'s at the end and that's about it.

By requiring a special character, capitals, or numbers (which you also shouldn't do) you are challenging the user on the first point above, that of memory and what you will often find is that a user prepends a '1' or a '#' on the end of their commonly used password.

So based on these points we can deduce that a user landing on a page will potentially have several very similar passwords in mind: ilovemydog ilovemydog123 !ilovemydog123 - by placing a reminder on the login page, which is the password related page that is really used often, I strongly suggest that you will help your users. If you optimise something to be forgotten by a human being then you should help them with a reminder wherever possible.

(Anecdotally I have arrived at exactly the same position as the OP where such a reminder would have helped me)

share|improve this answer

I agree with you.

Showing just "the requirements of the password creation" while attempting to login in most cases would help users remember which type of password they used in that Login system. That would even be better to show a message before user starts to write its password (when he/she puts the cursor in the password input field) and clarify the type of password that login system is requiring from the users. In this way intruders even can't distinguish if that username exists or not.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.