For registration forms, it seems the trend now is to allow any password a user wants, as long as you inform him if it's weak. With this in mind, should we still validate email fields on the client ...
Frequently, sites that should really value security (especially banks) ask for several individual characters from a password. Typically I've seen them do it like this: download bmml source ...
I currently have a page dedicated to changing passwords. There are 2 options: A 2 step option: download bmml source – Wireframes created with Balsamiq Mockups download bmml ...