A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

1
vote
5answers
88 views

How to prevent user form entering password to next to password field?

Being long time internet users I tend to fill forms barely looking at field labels, especially if it is as common and seemingly predictable as registration form. It often leads me into entering ...
1
vote
2answers
42 views

Necessary to force the user to differ the new password from the old one?

I need to rewrite our password change dialog currently. It's designed to check whether the old password differs from the new password. Old password: something New password: something New password ...
0
votes
1answer
92 views

User must change password but changing username its optional. Best UX design for this?

i have to design a page where the user (after login for first time) must change the password but its optional to change the username. I am not sure which is the best approach from UX perspective, if ...
3
votes
5answers
154 views

Lets the user set the password itself or send them one via mail after registration?

I have to built an order process for an energy provider. The order process is very big and the user needs 10-15 minutes to complete it with all the data. The last point is to set a password to access ...
6
votes
5answers
125 views

Improving on the abcdef password

Ok please reserve judgement on this. This is somewhere between a security and a UX question, plus it might be too broad. I think my question can be summarised as: What's the best way to engage a ...
8
votes
4answers
227 views

Should password field be cleared if Captcha is wrongly entered?

On registration screen there are 3 fields: Email, Password and Captcha. User has entered valid email and password but has entered wrong Captcha. Here an error message specific to the wrong Captcha ...
3
votes
2answers
160 views

Material design change password behavior

I am using this behavior to make user change password: When a user clicks on the change password button, 3 text fields appear and the button changes into a "cancel" button. Do I have to separate the ...
4
votes
2answers
731 views

Force log out users on applying a password policy?

Consider this use-case for an enterprise social network. Users have already signed up but after some time, the admin for the network decides to apply a password policy. Does applying a password ...
0
votes
0answers
22 views

Best way to display multiple usernames with options to sign in and reset password?

I'm trying to do a "I forgot my username" flow, but the problem I've been struggling with is figuring out the best way of displaying information multiple usernames with the option to sign in and reset ...
1
vote
1answer
49 views

Site examples which allow users to expose password field [closed]

I'm looking for some real world sites where the login control allows users to view the text inside the password field. I'm looking for examples of site-generated "Show Password" controls, not examples ...
4
votes
1answer
74 views

How to explain the concept of choosing password to user

We have an online store application that uses one-time passwords for user login. The user enters her email address, and we email her a one-time password to log in with. She doesn't choose any ...
3
votes
1answer
77 views

Observable password inputs

An obvious problem with passwords is that if an observer sees a user enter it, then the user has lost the password secrecy. Some systems try to defend against this with dark screens or with shields ...
3
votes
3answers
225 views

Why warn about caps lock for passwords, instead of ignoring caps lock for password characters?

Many login screens warn the user if the caps lock key is switched on. Most prominently the windows login screen. Does this offer any advantage compared to simply ignoring the caps lock key and ...
3
votes
3answers
106 views

Ask a user to change password (not mandatory action but desirable)

I'd like to know ways to encourage users to take action and change their password, specially those where security could be compromised (eg. 123456, 1234, abc123, etc). From now on these combinations ...
2
votes
1answer
100 views

What percent of users use iCloud or iCloud + Keychain? (Handoff and Safari SSO experience)

I am trying to prioritize the R&D and Q/A for the following Apple iOS features: Handoff (Sharing current documents among active devices) Keychain (Where a password in Safari can be saved ...
7
votes
1answer
272 views

Decision tree / flow diagram for mobile email / password confirmation

This UI design pattern keeps coming up and I'm wondering whether there are any best practices out there that can improve the quality of my solution. The pattern is: type your email (or password), re-...
0
votes
0answers
24 views

Creating a new password for login [duplicate]

I have noticed recently - that MOST websites - when you go through the "forgot password" loop - that you go to a page - enter your new password - and then they'll say "You have successfully updated ...
2
votes
1answer
63 views

Display time to crack password in 2 different scenarios

I'm making an alternative to Roboform's How Secure is my Password with Dropbox's zxcvbn. A cool feature of zxcvbn is that it not only returns the amount of time required for cracking the password ...
7
votes
4answers
287 views

How to guide minors to create strong passwords

I am designing a web application for 10-13 year olds that will be used in schools. When the kids create their account, they will be asked to create a password. I am struggling to come up with a way ...
21
votes
5answers
3k views

What is the best practice for password field placeholders?

It seems like the accepted best practice for email fields is to have a label and an example email address. Assuming you want a consistent style, the label will make it clear that it's a password field....
3
votes
2answers
231 views

change password on first use (using temporary password from letter)

I am working on a financial web app which clients access to view their funds. Currently the clients are sent a letter with a temporary password for first login which when used takes them to a change ...
1
vote
1answer
125 views

Why enter again (or at the very least confirm) my email address when I click “Forgot password”?

In most, if not all, web forms for logging into a site, you have your forgot password link. When clicking the link, you get a new form (usually in a new page) either empty (!) or prefilled with the ...
4
votes
5answers
296 views

Should editing a password be 2 step process or all in one form?

We have a web application whereby a user's profile screen uses a card-based layout. One of the cards allows users to update their password. Our team is split on how the password card should be laid ...
1
vote
1answer
128 views

Forgot Password Icon? How's this? [closed]

I've been using just a little speech bubble with a question mark in the middle to signify a lost password link, like this one: For a redesign of the site, I've created a new one that I think better ...
1
vote
1answer
124 views

How to show password on a user's profile page

I'm working on a web application with a profile page, which is browsed by admin. According to scenario admin may see and change all the information on user's page including the password. User himself ...
4
votes
9answers
512 views

Would you get rid of Password field in sign-up form

Imagine this, you are signing-up for a product and you get asked the same old questions when creating an account(Name, email address etc) with the exception of a password. After you sign-up, an email ...
4
votes
1answer
272 views

Where to redirect the user after a password recovery email has been sent

I am working on the flow for password recovery and can't determine where to redirect the user once an email has been sent to help them complete the process. They enter their email address on this page ...
3
votes
2answers
125 views

Should a (permanent) password field show the correct amount of bullets of the entered password?

I'm working on an desktop program and noticed the following interface: Don't want to go into the details of the form, but basically, the user can enter an alternative username/password to login ...
50
votes
10answers
7k views

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

Someone came up with this proposed behavior recently and I haven't been able to find examples of services working the same way. I have to say I don't really like it, but can't put my finger on a ...
9
votes
3answers
481 views

Implementing a passphrase instead of a password

I was reading about UX and passwords to try to decide on explaining the requirements (ex: 1 capital letter, 1 number, 1 special character,eight characters) and came across this answer which sent me ...
3
votes
1answer
127 views

Data on benefits of show password reset form

Most UX designers are clear that having 1 new password field with a mechanism to show the password is a better user experience than using 2 fields for 'New password' and 'Confirm password'. Is there ...
0
votes
2answers
115 views

Prompting user for password input with inline editing

I have a page where the user can edit their settings using inline editing. https://jsfiddle.net/ahw97j7r/3/embedded/result/ Useless stuff just updates the database, but Password and Email are a ...
0
votes
2answers
61 views

Should the user's password field be included (with all the hassle) on the settings page?

What is the best implementation of changing user settings with respect to the password change? I have a rails app, and if a user goes to the "update profile" page, the password field has to be re-...
60
votes
3answers
5k views

Why do some websites (including Google) trim whitespaces in passwords?

I have just noticed that Google as well as some other sites trims the whitespaces in the password. I can successfully sign into my google account even if I add extra spaces in the end of my password. ...
0
votes
3answers
123 views

Is there an accepted standard for passwords?

It's frustrating how some websites require symbols while some don't allow them, some require a capital or number while others don't, some don't allow the same consecutive characters, etc. Every once ...
13
votes
2answers
533 views

Why not show password criteria on login screen?

I have frequently bumped into this issue: sites ask for my password (e.g. Stack Exchange itself) when I want to do something like updating my profile. This is per se a low priority site for me so I ...
2
votes
2answers
89 views

Should users be given the option to sign up to a website without having to set a password?

For many sites as a user I'm not really bothered about security as there's little of value on the site So should users be given the option of signing up to a website without setting a password ?
6
votes
4answers
389 views

How many atempts should you give a user before invalidating his password?

What I am trying to avoid here is brute force attacks on a user's password. And I am thinking about doing that by invalidating his password when too many attempts are made in the same minute, hour, ...
14
votes
2answers
2k views

Which is the better UX for a user to see their password at the login screen?

These are the two options I'm considering. Having a tickbox for a 'show password' option, which would let the user see their password. A 'caps lock' icon would be in the password text area which ...
4
votes
1answer
135 views

Is there any research into whether/how people save username/password combinations?

It's something of an open secret that many people don't handle the security of their accounts online in the same way the designers of such systems would want them to. This is why we often see text ...
67
votes
11answers
14k views

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
2
votes
0answers
17 views

Is it a good idea to expire passwords after a time relative to their complexity? [duplicate]

Is it a good idea to expire passwords after a time relative to their complexity? Is it a good way to teach users to use secure passwords? (relevant xkcd: correct horse battery staple) I'm thinking of ...
14
votes
8answers
2k views

Should password reset functionality email a temporary password or just a reset link?

When a user submits a reset password form, which UX is preferred? A temporary password is created for them to use. It's emailed to them. They log in and then a permanent change password form is ...
1
vote
3answers
167 views

Is it ever useful to show the Password Requirements on page load?

I have a hypothesis that I have no idea how to test other than lots of observational testing, but perhaps someone has covered this already. On signing up to a new service and being presented with the ...
92
votes
14answers
11k views

Should passwords expire?

I have a dispute with my partner. He comes from a financial software background but I do not. He recommends that our web app should expire user's passwords after 6 months (and it has to be unique each ...
0
votes
0answers
64 views

Any suggestions for letting user Activation by clicking link OR typing in confirmation code?

Sometimes, our users do not have access to their email on the same device they are using our web app on, for example, they can check their email on their iphone, but the iphone is too small to use ...
1
vote
1answer
161 views

Inform user of invalid email on password reset

Should the user be told if they enter an email which is not in the database? User forgets their password and clicks a link to reset it. Page displays "An email was just sent out to youremail@bla.com ...
1
vote
2answers
108 views

Should I use multiple '*' when typing in one character?

I am designing a secure password login page. I am thinking about outputting multiple * for one typed character. For example: User types: a Password field shows: ****** My rationale for this is ...
2
votes
2answers
133 views

Any evidence password strength indicators break user journey?

Have any studies been conducted on whether password strength indicators break user journey's. Here is a hypothetical scenario: As a customer of an eCommerce website, I am ready to make a purchase ...
3
votes
4answers
209 views

What is the best way to ask users for multiple passwords?

I am creating an app which includes payments and by following banking regulations I need to ask the users for a four-digit password as well as an OTP (one-time PIN sent to the user's phone) every time ...