A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

99
votes
11answers
16k views

Why should we ask the password twice during registration?

It would be easier to ask for a user's password only once during registration. The problem: The user could make a mistake while typing the password once because of hiding letters. The solution: The ...
70
votes
14answers
12k views

Is a “repeat password” field necessary in a signup page? [duplicate]

Possible Duplicate: Why should we ask the password twice during registration? When designing a new and simplified signup page I got into an argument with a colleague about the necessity of ...
46
votes
10answers
3k views

What is the best way to inspire users to choose strong password?

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be ...
10
votes
5answers
3k views

Is only having a single unmasked password field (no confirm) on a registration page a bad idea?

Some sites allow you to register and only provide a single password box, which is protected with stars. Traditionally a "confirm password" box is used when registering which allows you to confirm ...
20
votes
3answers
2k views

Should password fields have an unmask checkbox?

Is it a good idea to have an unmask checkbox for user selection when the users type their password to show them what they typed?
12
votes
5answers
2k views

Pros and Cons for having same form for login, register and forgotten password

I have notice some sites have the same form for login, register and forgotten password. Below the form you have 3 buttons i forgot my password register log me in What are the pros and cons on ...
86
votes
14answers
9k views

Should passwords expire?

I have a dispute with my partner. He comes from a financial software background but I do not. He recommends that our web app should expire user's passwords after 6 months (and it has to be unique each ...
34
votes
5answers
4k views

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
3
votes
6answers
543 views

How to present password rules

How should feedback be given about password rules in registration forms? a) When you focus on the password field b) When you type the first letter of the password c) When you stop typing, plus a ...
9
votes
9answers
499 views

barebone registration: is password repitition and captcha really essential?

If you design a barebone registration form which only requires email address and password as essentials can you omit the password repetition and captcha without too much technical trouble? I ...
6
votes
5answers
863 views

Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
5
votes
3answers
2k views

How to show password reset option

In my website I put password recovery option hidden. I know there are two options to deal with it. Classical way, Show it as the next sentence to the register link. Example, "Want to try? Sign up ...
12
votes
2answers
314 views

Why not show password criteria on login screen?

I have frequently bumped into this issue: sites ask for my password (e.g. Stack Exchange itself) when I want to do something like updating my profile. This is per se a low priority site for me so I ...
4
votes
3answers
175 views

Forcing Users To think up More Complex Passwords / Ease of Remembering Them

Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have ...
16
votes
2answers
934 views

Should we send both username and password after registration?

After users have registered on a website, should that website send both username and password in their registration confirmation email ?
6
votes
3answers
384 views

Expected behaviour when clicking to reset a password multiple times?

When a user uses the »I forgot my password« link several times and gets a couple of emails, each one with a tokenized link to reset his password, what would be the appropriate behaviour? All links ...
58
votes
11answers
8k views

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
17
votes
7answers
3k views

Are there numbers and letters to avoid for activation codes via SMS?

We are at a fairly early stage in our application development and have run into a usability issue related to typing an activation code sent via SMS into a browser URL. Here's the basic scenario: ...
8
votes
3answers
859 views

Usability and security for user access and password handling in a web application?

I'm looking at putting together a website aimed at ordinary users that will handle personal data which I don't want to be compromised. How can I make the site secure but also usable? It seems most ...
4
votes
6answers
2k views

Is it necessary to verify a user's email address?

It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code. Is it really necessary to do this ...
4
votes
7answers
1k views

Is it good user experience to only require an email address at signup?

Is it a good idea to only require an email address from users at signup (without a password or other details)? After they sign up, we will send a random password to their email address; this password ...
26
votes
6answers
2k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
14
votes
7answers
1k views

Password field in cleartext

I'm building a mobile web app that will request a bunch of information from the user (name, dob, address, etc) and am trying to cut down as much fields as I can. I've noticed a new trend where mobile ...
10
votes
4answers
1k views

Should we disallow common passwords like “password” and “12345”?

Studies show that people can use some really "insecure" passwords. Here's Mashables worst 25 passwords of 2011 for example. To protect security on our sites (and the overall experience of less-hacked ...
17
votes
6answers
1k views

Why do users erase all the password when they hit one wrong key, instead of just the last wrong character?

We login to applications almost every day. The password is stored in our fingers, as an automated process (if they have used it long enough). When users realize they have entered a wrong character ...
13
votes
5answers
2k views

Should I let a user copy/paste into a confirm e-mail field for a registration form? [duplicate]

Possible Duplicate: Preventing a user from pasting from the clipboard into a mandatory form field There was a question of stackoverflow, that a programmer did not wont to let the new users ...
6
votes
4answers
233 views

How many atempts should you give a user before invalidating his password?

What I am trying to avoid here is brute force attacks on a user's password. And I am thinking about doing that by invalidating his password when too many attempts are made in the same minute, hour, ...
3
votes
2answers
278 views

Remember Me in an enterprise application: What to remember?

I've just finished a well-thought login validation mechanism and have asked myself the following question several times: What does the user expect when he checks the Remember me checkbox in an ...
9
votes
3answers
955 views

Should password fields be blanked when inline validation fails?

This question with a similiar name refers to registration, but in my case, I would like to address submission. My use cases are: A login form consisting of a email address. A change password form ...
7
votes
3answers
82 views

Accessing secure content

Which of the permutations for accessing secure content do folks prefer? In this instance I'm referring to a saved quote and have usernames, email addresses and quote reference numbers available. ...
5
votes
4answers
513 views

Forgotten passwords - should the temporary password expire?

Just designing the forgotten password form for a retailer. When researching other retailers, I've have noticed the temporary password link that gets sent to inbox's expire after a few hours. What is ...
1
vote
1answer
103 views

What is a Design pattern for “Remember Me” that forces user to explicitly choose “remember” or "do not remember?

We have a very nontechnical user base. We provide a "Remember Me on this computer" option (checked by default) but perhaps it should not be checked by default. However, I want to make sure they have ...