A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

4
votes
2answers
242 views

On login-failure; should site tell if it was the login-name or the password that was incorrect? [duplicate]

If a login fails; should the site explicitly tell the user if it was the username or the password that was wrong? or should it just tell that the combination of username/password was wrong (ie. no ...
27
votes
6answers
2k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
8
votes
2answers
1k views

Website registration/login process with highest success rate? [duplicate]

I'm looking for data about how to implement a registration and login process for a new website. We are currently considering four options: Login with email address and password that is stored in ...
13
votes
6answers
722 views

What is the best way to request individual characters from a password?

Frequently, sites that should really value security (especially banks) ask for several individual characters from a password. Typically I've seen them do it like this: download bmml source ...
20
votes
3answers
2k views

Should password fields have an unmask checkbox?

Is it a good idea to have an unmask checkbox for user selection when the users type their password to show them what they typed?
3
votes
1answer
4k views

Telling users passwords don't match and aren't strong enough

I have two functions in my user registration form One checks the password and confirmed password are the same. The other checks if the password is strong enough. I have two presentation related ...
3
votes
2answers
117 views

studies on passcode/keypad versus password/keyboard?

When designing a tablet-based app that needs it's own extra security, there seems to be a couple of common choices: add a password screen with a keyboard, or use a passcode screen that has a keypad. ...
47
votes
17answers
7k views

Computer login with password only, without username

I have an idea to simplify the login screen on things like home computers with a small number of users (say, 2-10) with passwords. Today, a typical home computer's login screen has three steps: ...
12
votes
7answers
2k views

How to handle “forgot password” when user has not confirmed email?

If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very ...
11
votes
2answers
2k views

Email confirmation on password reset?

I am building a prototype to a system that has a user account system in place. Of course with any account system, the user should be able to reset their password should the need arise (e.g., ...
2
votes
1answer
152 views

Is it a good Idea to provide change password option on the login page?

I am reviewing a banking site and the site has change password link upfront on the login page with an option for old password and new password, which verifies the old password before changing to the ...
3
votes
3answers
3k views

Case sensitive vs case insensitive passwords

My website has always used case insensitive passwords for millions of users. The security specialist is pushing us to change to case sensitive passwords. Are there any studies or best practices on ...
8
votes
3answers
4k views

Should my app send a confirmation email on user registration?

I'm grappling with the user registration experience for my application. I'm considering this model: User enters... Username Password Password confirmation Email address The app displays a ...
15
votes
5answers
2k views

Should I use two steps or one when users change password?

I currently have a page dedicated to changing passwords. There are 2 options: A 2 step option: download bmml source – Wireframes created with Balsamiq Mockups download bmml ...
1
vote
2answers
417 views

show password user experience

I have an email and password field on the sign up form. A password rule text and a show password checkbox appear below the password field. The rules for showing the div containing password hint text ...
17
votes
6answers
1k views

Why do users erase all the password when they hit one wrong key, instead of just the last wrong character?

We login to applications almost every day. The password is stored in our fingers, as an automated process (if they have used it long enough). When users realize they have entered a wrong character ...
0
votes
0answers
84 views

Is two-field confirmation for emails or passwords user-friendly? [duplicate]

Possible Duplicate: Why should we ask the password twice during registration? It is a very common pattern to require a user to enter things like an email address, or - more importantly - a ...
4
votes
1answer
125 views

Encryption of chat messages and possibility of password loss

I have a client-server chat like app. I would like to add an encryption of messages for users. So, that they will be sure that no one, even service owner, can read their confidential information. I'm ...
2
votes
1answer
147 views

User Authentication/Timeout for web-app with personal Information

The concept behind "Remember my Username" and even allowing browsers to save your "username and password" for this site seems like it could be controversial. Given that different audiences prefer ...
4
votes
2answers
634 views

Forgot Password Alternatives?

Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords. Our current ...
6
votes
2answers
534 views

Should we require confirmation before resetting a password?

If a user has forgotten their password for a service, the convention is that they should need only their username and/or registered email address in order to reset their password -- in our case that ...
1
vote
1answer
415 views

Should I provide a “Forgot Password” option for a one-time sign in Android application?

Right now we are developing an android application for a website. In the web site there is this "Forgot Password" option. But should i have that option in my android application too?? Anyways i am ...
9
votes
3answers
1k views

Should password fields be blanked when inline validation fails?

This question with a similiar name refers to registration, but in my case, I would like to address submission. My use cases are: A login form consisting of a email address. A change password form ...
11
votes
5answers
3k views

Is only having a single unmasked password field (no confirm) on a registration page a bad idea? [duplicate]

Some sites allow you to register and only provide a single password box, which is protected with stars. Traditionally a "confirm password" box is used when registering which allows you to confirm ...
6
votes
4answers
2k views

Why do sites split 'password' and 'username' retrieval into two separate operations?

I find this way of doing it highly annoying when I come back to a site I haven't used in a while. First having to enter my email to get my username and then enter my username and email to reset my ...
4
votes
7answers
2k views

Is it good user experience to only require an email address at signup?

Is it a good idea to only require an email address from users at signup (without a password or other details)? After they sign up, we will send a random password to their email address; this password ...
3
votes
4answers
911 views

Password validation in login form

In registration form, I have client side validation for strength of password. For example password should be not less than 6 symbols, consists at least 1 digit, and at least 1 letter. For example: ...
10
votes
4answers
1k views

Should we disallow common passwords like “password” and “12345”?

Studies show that people can use some really "insecure" passwords. Here's Mashables worst 25 passwords of 2011 for example. To protect security on our sites (and the overall experience of less-hacked ...
17
votes
7answers
4k views

Are there numbers and letters to avoid for activation codes via SMS?

We are at a fairly early stage in our application development and have run into a usability issue related to typing an activation code sent via SMS into a browser URL. Here's the basic scenario: ...
107
votes
14answers
19k views

Why should we ask the password twice during registration?

It would be easier to ask for a user's password only once during registration. The problem: The user could make a mistake while typing the password once because of hiding letters. The solution: The ...
0
votes
2answers
1k views

Why does the AppStore prompt the user for password for free apps? [closed]

This is something I've been thinking about for a while. Why does the App Store prompt the user for a password regardless whether the app is free or not? My theory is that of consistency; Since you ...
16
votes
2answers
969 views

Should we send both username and password after registration?

After users have registered on a website, should that website send both username and password in their registration confirmation email ?
6
votes
3answers
2k views

How to show password reset option

In my website I put password recovery option hidden. I know there are two options to deal with it. Classical way, Show it as the next sentence to the register link. Example, "Want to try? Sign up ...
5
votes
1answer
428 views

Usable examples, recommended practices for interfaces optimized for using pass-phrases instead of passwords

Reading through What is the best way to inspire users to choose strong password?, I realized I have never used an interface where the primary login password system would use pass-phrases (and where ...
46
votes
10answers
4k views

What is the best way to inspire users to choose strong password?

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be ...
4
votes
3answers
643 views

What solutions do you use to host html prototypes for your clients [closed]

I have been using a basic hosting service to host html prototypes for clients. I have realized that I need a solution that can offer me greater control e.g. to allow me to set master passwords for all ...
11
votes
10answers
2k views

What is an easier unlock pattern: gesture or code?

There are two popular ways to unlock a phone. iPhone makes you type in a numerical code. Android gives you the option to draw a gesture. Which of these two is easier to remember and easier to execute? ...
6
votes
1answer
176 views

Sign-in Methods for Visitors without Social Networking Profiles

If a visitor needs to sign-on at your site and they don't have any social profiles, their only option is to use a traditional (double opt-in) registration process. That is why websites should always ...
3
votes
4answers
205 views

Best method of rating passwords

I'm creating a webpage which has user accounts and I'd like input on the best way of rating the user's password. There are four ways to rate passwords which I have encountered: Rate the password ...
6
votes
4answers
1k views

Any usability studies on password strength meters?

I put together a password strength meter for a signup form, and overall it works very well. It hooks into our DB for the "rules" (number of characters required, mix of letters and numbers, etc.), and ...
2
votes
1answer
187 views

Best way to add account providers?

I briefly looked at spotify and I found that they use 2 providers: Themselves and facebook. Ie I can log in to spotify with facebook. But then it asks me for my spotify account when I downloaded the ...
6
votes
5answers
925 views

Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
10
votes
4answers
2k views

Social Login adoption vs Traditional Login

I have implemented janrain's social login on my website. I am wondering how important it is to include a traditional login (email/password) system. I believe there may be a significant percentage of ...
2
votes
3answers
755 views

Is it good to create a separate screen for change password?

I have a web-page to create a new user; Now, I want to use the same page for editing the user's profile. Is it good to use the same page for change password? OR do I have to create a separate page, ...
5
votes
2answers
263 views

Password and in place editing

I decided to support in place editing for a simple user table. I am not sure what i should do about password... When i create a new user i can have a textbox to type... When viewing i can hide then ...
6
votes
3answers
493 views

How should the sign-up page for a mobile website work?

How should the sign-up page for a mobile website be? For example:- Does repeat password make more sense or less on mobile version of a website. To put it differently, are users more prone to make a ...
3
votes
3answers
311 views

Best practice for log-in procedure in a conference-app [closed]

I'm preparing an app for a closed conference with log-in functionality. All the participants are on an email-list. How do other App's deal with the challenges around obtaining the initial ...
13
votes
5answers
2k views

Is it appropriate to display the warning message “Caps Lock is on”?

Is it appropriate to display the warning message "Caps Lock is on" when focus shifts to Password field? In gmail and yahoo I don't see it. So, what does the standard say?
19
votes
4answers
2k views

Should I trim spaces in passwords?

The problem is that we send a user an email with a generated password if they forget. If they choose to cut and paste it in, then Outlook typically adds a " " to the end of it. When they paste it ...
4
votes
1answer
2k views

iPhone App: Best practice for sign in with password recovery?

I'm in the process of wireframing an iPhone App for a big website with some functions that can only be used by signed in users (e.g. favorites, saved searched). Many apps use the modal dialog to ...