A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

4
votes
5answers
229 views

Should editing a password be 2 step process or all in one form?

We have a web application whereby a user's profile screen uses a card-based layout. One of the cards allows users to update their password. Our team is split on how the password card should be laid ...
1
vote
1answer
84 views

Forgot Password Icon? How's this? [closed]

I've been using just a little speech bubble with a question mark in the middle to signify a lost password link, like this one: For a redesign of the site, I've created a new one that I think better ...
1
vote
1answer
68 views

How to show password on a user's profile page

I'm working on a web application with a profile page, which is browsed by admin. According to scenario admin may see and change all the information on user's page including the password. User himself ...
3
votes
9answers
326 views

Would you get rid of Password field in sign-up form

Imagine this, you are signing-up for a product and you get asked the same old questions when creating an account(Name, email address etc) with the exception of a password. After you sign-up, an email ...
4
votes
1answer
138 views

Where to redirect the user after a password recovery email has been sent

I am working on the flow for password recovery and can't determine where to redirect the user once an email has been sent to help them complete the process. They enter their email address on this page ...
3
votes
2answers
102 views

Should a (permanent) password field show the correct amount of bullets of the entered password?

I'm working on an desktop program and noticed the following interface: Don't want to go into the details of the form, but basically, the user can enter an alternative username/password to login ...
50
votes
10answers
6k views

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

Someone came up with this proposed behavior recently and I haven't been able to find examples of services working the same way. I have to say I don't really like it, but can't put my finger on a ...
9
votes
3answers
272 views

Implementing a passphrase instead of a password

I was reading about UX and passwords to try to decide on explaining the requirements (ex: 1 capital letter, 1 number, 1 special character,eight characters) and came across this answer which sent me ...
3
votes
1answer
103 views

Data on benefits of show password reset form

Most UX designers are clear that having 1 new password field with a mechanism to show the password is a better user experience than using 2 fields for 'New password' and 'Confirm password'. Is there ...
0
votes
2answers
81 views

Prompting user for password input with inline editing

I have a page where the user can edit their settings using inline editing. https://jsfiddle.net/ahw97j7r/3/embedded/result/ Useless stuff just updates the database, but Password and Email are a ...
0
votes
2answers
53 views

Should the user's password field be included (with all the hassle) on the settings page?

What is the best implementation of changing user settings with respect to the password change? I have a rails app, and if a user goes to the "update profile" page, the password field has to be ...
55
votes
3answers
5k views

Why do some websites (including Google) trim whitespaces in passwords?

I have just noticed that Google as well as some other sites trims the whitespaces in the password. I can successfully sign into my google account even if I add extra spaces in the end of my password. ...
0
votes
3answers
105 views

Is there an accepted standard for passwords?

It's frustrating how some websites require symbols while some don't allow them, some require a capital or number while others don't, some don't allow the same consecutive characters, etc. Every once ...
12
votes
2answers
387 views

Why not show password criteria on login screen?

I have frequently bumped into this issue: sites ask for my password (e.g. Stack Exchange itself) when I want to do something like updating my profile. This is per se a low priority site for me so I ...
2
votes
2answers
76 views

Should users be given the option to sign up to a website without having to set a password?

For many sites as a user I'm not really bothered about security as there's little of value on the site So should users be given the option of signing up to a website without setting a password ?
6
votes
4answers
264 views

How many atempts should you give a user before invalidating his password?

What I am trying to avoid here is brute force attacks on a user's password. And I am thinking about doing that by invalidating his password when too many attempts are made in the same minute, hour, ...
14
votes
2answers
2k views

Which is the better UX for a user to see their password at the login screen?

These are the two options I'm considering. Having a tickbox for a 'show password' option, which would let the user see their password. A 'caps lock' icon would be in the password text area which ...
4
votes
1answer
91 views

Is there any research into whether/how people save username/password combinations?

It's something of an open secret that many people don't handle the security of their accounts online in the same way the designers of such systems would want them to. This is why we often see text ...
61
votes
11answers
9k views

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
1
vote
0answers
15 views

Is it a good idea to expire passwords after a time relative to their complexity? [duplicate]

Is it a good idea to expire passwords after a time relative to their complexity? Is it a good way to teach users to use secure passwords? (relevant xkcd: correct horse battery staple) I'm thinking of ...
14
votes
8answers
872 views

Should password reset functionality email a temporary password or just a reset link?

When a user submits a reset password form, which UX is preferred? A temporary password is created for them to use. It's emailed to them. They log in and then a permanent change password form is ...
1
vote
3answers
124 views

Is it ever useful to show the Password Requirements on page load?

I have a hypothesis that I have no idea how to test other than lots of observational testing, but perhaps someone has covered this already. On signing up to a new service and being presented with the ...
88
votes
14answers
9k views

Should passwords expire?

I have a dispute with my partner. He comes from a financial software background but I do not. He recommends that our web app should expire user's passwords after 6 months (and it has to be unique each ...
0
votes
0answers
40 views

Any suggestions for letting user Activation by clicking link OR typing in confirmation code?

Sometimes, our users do not have access to their email on the same device they are using our web app on, for example, they can check their email on their iphone, but the iphone is too small to use ...
1
vote
1answer
86 views

Inform user of invalid email on password reset

Should the user be told if they enter an email which is not in the database? User forgets their password and clicks a link to reset it. Page displays "An email was just sent out to youremail@bla.com ...
1
vote
2answers
104 views

Should I use multiple '*' when typing in one character?

I am designing a secure password login page. I am thinking about outputting multiple * for one typed character. For example: User types: a Password field shows: ****** My rationale for this is ...
2
votes
2answers
127 views

Any evidence password strength indicators break user journey?

Have any studies been conducted on whether password strength indicators break user journey's. Here is a hypothetical scenario: As a customer of an eCommerce website, I am ready to make a purchase ...
3
votes
4answers
193 views

What is the best way to ask users for multiple passwords?

I am creating an app which includes payments and by following banking regulations I need to ask the users for a four-digit password as well as an OTP (one-time PIN sent to the user's phone) every time ...
0
votes
1answer
86 views

Are there any good guidelines to how many passwords a user can safely remember?

In an ideal world we each would have one password to remember, and that would be a strong password and we would change it every month or so. But we don't live in an ideal world, and we have to access ...
1
vote
3answers
274 views

When should I validate that the password in a confirmation field matches the first password entered?

If a user creation page has a field where you are asked to re-enter your password, when should the page validate that the second password matches the first? I do not have control over whether or not ...
2
votes
1answer
96 views

Automatic login on password reset

This question has been raised on http://security.stackexchange.com/questions/40723/why-do-you-need-to-login-after-you-change-a-password - With security in mind As one user states: "From a security ...
-2
votes
1answer
79 views

Username & Password for selling page Yes or No?

I appreciate your given opinion about this: I intend to send an email to a specific target audience in order to offer small business owners (around the world) a product which is not cheap. (I don't ...
1
vote
4answers
204 views

“My account” page mockup - change password form on this page?

I am mocking up a very minimalistic user-account page. It consists of just three functions - a counter that displays your available uses, field to redeem a code and a link to a form where you can ...
4
votes
2answers
195 views

Change Password Form

When allowing a user to change their password is it necessary to add a confirm password field? as follows: Current Password New Password Password Strength Meter Confirm New Password (Is this field ...
2
votes
1answer
399 views

Best practices for picture password implementation

Instead using of the conventional password design (***** in a text entry field) in my mobile application, I've been thinking about letting the user create a 4 item password from a collection of 10 ...
1
vote
2answers
87 views

Does a crime security alert app need its users to register?

I was asked to work on a police security alert system as a school project. The app notifies a user about security info and lets users (citizens of a place) notify police agencies around them. I was ...
3
votes
1answer
299 views

Show special keyboard view when entering a password on mobile devices?

Mobile operating systems typically show different virtual keyboards depending on context. The default keyboard might show A-Z, while a keyboard for entering a telephone number might show 0-9 (so you ...
0
votes
1answer
133 views

Security questions vs secret password/passcode when logging in or retrieving login details?

I am currently in the process of re-designing a login process which uses security questions to verify the identity of users before they are successfully logged in, and also to allow them to reset ...
1
vote
1answer
70 views

Registration form inline password generation?

A client has given me "design direction" for their site's account creation form (it's a utility site) that includes an option to have the system generate a password for the user inline on the form, ...
1
vote
1answer
85 views

“Change password”, “change your password” or “pick a new password”?

I have seen these different phrases on various websites and I was wondering which one sounds warmer, more inviting and more trustworthy? Which is more user-friendly? Personally I don't understand ...
2
votes
3answers
149 views

Should ergonomics be added to password strength meters?

After getting locked out of my account for typing in my password incorrectly several times in a row, I realized that the password I chose is too prone to typos and has resulted in locked accounts. It ...
0
votes
1answer
75 views

Password recovery process: temporal password vs. change it yourself

I'm looking for analyzing if giving a temporal password when some user forgets its actual password and requires to log into an application (in my case, it's a Web application) is a good idea. From my ...
1
vote
1answer
146 views

Reverse and optimize the sign up process for double opt-in

The perceived majority of websites have a quite similar approach to double opt-in signups: all information required to sign up is required before sending a confirmation e-mail. The confirmation e-mail ...
4
votes
6answers
462 views

Wouldn't it be a good UX practice to give hints to users to help them remember their passwords?

Although most of the places on the internet allow users to login with their existing Google or Facebook account, there are still many places where this is not an option. In such cases, remembering ...
4
votes
3answers
185 views

Forcing Users To think up More Complex Passwords / Ease of Remembering Them

Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have ...
1
vote
1answer
618 views

Password reset with lost email functionality

I have searched and viewed most of the other questions and answers about implementing forgot password functionality on a website. However, we have a unique situation. When a user registers an account ...
1
vote
1answer
120 views

What is a Design pattern for “Remember Me” that forces user to explicitly choose “remember” or "do not remember?

We have a very nontechnical user base. We provide a "Remember Me on this computer" option (checked by default) but perhaps it should not be checked by default. However, I want to make sure they have ...
1
vote
1answer
48 views

Passwords: Speed of conversion from displayed to 'starred'

On an Android phone, passwords are automatically converted to a 'starred' format a few seconds after each character is input. However I find this happens too quickly to visually double check that I ...
1
vote
2answers
117 views

Potential UX issues with password-less logins?

There is a fantastic article entitled Is it time for password-less login? that suggests that we could use the "reset password" link as the default login action to any site. It provides a lot of ...
0
votes
1answer
96 views

Optional password field on login

We want all users to enter their employment ID so we can identify them, but it's not so important that we require them to register or remember a password. Some users will be registered for the ...