A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

11
votes
10answers
2k views

What is an easier unlock pattern: gesture or code?

There are two popular ways to unlock a phone. iPhone makes you type in a numerical code. Android gives you the option to draw a gesture. Which of these two is easier to remember and easier to execute? ...
0
votes
1answer
43 views

Password recovery process: temporal password vs. change it yourself

I'm looking for analyzing if giving a temporal password when some user forgets its actual password and requires to log into an application (in my case, it's a Web application) is a good idea. From my ...
4
votes
6answers
253 views

Wouldn't it be a good UX practice to give hints to users to help them remember their passwords?

Although most of the places on the internet allow users to login with their existing Google or Facebook account, there are still many places where this is not an option. In such cases, remembering ...
0
votes
1answer
35 views

Reverse and optimize the sign up process for double opt-in

The perceived majority of websites have a quite similar approach to double opt-in signups: all information required to sign up is required before sending a confirmation e-mail. The confirmation e-mail ...
1
vote
3answers
93 views

UI for a sign-in screen which allows to log in with a username or phone number

I have a sign-in screen which allows a user to log in with a username or a phone number. As the phone number must be in an "international" format, it confuses users, some of them fail to sign in. To ...
2
votes
2answers
96 views

Forcing Users To think up More Complex Passwords / Ease of Remembering Them

Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have ...
1
vote
1answer
77 views

Password reset with lost email functionality

I have searched and viewed most of the other questions and answers about implementing forgot password functionality on a website. However, we have a unique situation. When a user registers an account ...
1
vote
1answer
48 views

What is a Design pattern for “Remember Me” that forces user to explicitly choose “remember” or "do not remember?

We have a very nontechnical user base. We provide a "Remember Me on this computer" option (checked by default) but perhaps it should not be checked by default. However, I want to make sure they have ...
1
vote
1answer
45 views

Passwords: Speed of conversion from displayed to 'starred'

On an Android phone, passwords are automatically converted to a 'starred' format a few seconds after each character is input. However I find this happens too quickly to visually double check that I ...
1
vote
2answers
69 views

Potential UX issues with password-less logins?

There is a fantastic article entitled Is it time for password-less login? that suggests that we could use the "reset password" link as the default login action to any site. It provides a lot of ...
0
votes
1answer
57 views

Optional password field on login

We want all users to enter their employment ID so we can identify them, but it's not so important that we require them to register or remember a password. Some users will be registered for the ...
6
votes
4answers
1k views

Why do sites split 'password' and 'username' retrieval into two separate operations?

I find this way of doing it highly annoying when I come back to a site I haven't used in a while. First having to enter my email to get my username and then enter my username and email to reset my ...
2
votes
3answers
98 views

When is the best time to ask a user to create a password?

I have seen some services ask the user to create a password on the initial signup form. I have seen others only ask the user to create a password after clicking on a verification link sent to their ...
8
votes
2answers
141 views

Variable Password Requirements Help

Standford University recently published a quick guide to their password requirements: While I quite like this method and this guide is great, I can't think of a nice way to concisely express this ...
4
votes
4answers
113 views

Should password complexity be shown at login page?

I believe most (or at least: many) users have passwords pretty much standard - they tend to use even literally the same password for most of the systems they access. This is insecure, of course, but ...
3
votes
2answers
112 views

Password Complexity Requirements

Anyone has research or data that shows correlation between using password complexity requirements and sign up conversion rate? Example of password complexity requirement:
6
votes
3answers
462 views

How should the sign-up page for a mobile website work?

How should the sign-up page for a mobile website be? For example:- Does repeat password make more sense or less on mobile version of a website. To put it differently, are users more prone to make a ...
10
votes
4answers
1k views

Allowing every password of 6+ characters. Good practice?

I am developing a file sharing and hosting service, and right now I don't have any requirements set other then that a password has to be at least 6 characters long. I also accept all characters. I'm ...
34
votes
10answers
4k views

Is it good idea to send user password upon register?

I can imagine both ways - send / not send and still make it secure enough inside application. For instance: I get the password from "Enter your password" field, store it in email template and then ...
86
votes
11answers
11k views

Why should we ask the password twice during registration?

It would be easier to ask for a user's password only once during registration. The problem: The user could make a mistake while typing the password once because of hiding letters. The solution: The ...
2
votes
2answers
151 views

Logout after password change?

What is the convention regarding the following scenario: In a given system, a user is already logged in. He perform some tasks and then he change his own password. After this point, what should ...
0
votes
3answers
132 views

Forgot Password Inline vs. Separate Page

I recently encountered this approach for the Forgot Password link on the LLS site. When you select the link, you are not taken to another page. Instead, an email field is displayed. This seems to be a ...
2
votes
1answer
77 views

Changing password in user settings. Best method

I'm trying to think of the 'best' way for a user to change its password along with its user settings(Like name, e-mail etc.) I've got a form like this: Name: [text input] E-mailaddress: [text input] ...
33
votes
14answers
4k views

Argument for/against splitting login process into checking username, then ask password?

My boss has insisted for a while that our login process be divided into two steps on separate pages: on the first page, ask the user's e-mail address. On the second page, either display "user found" ...
2
votes
3answers
242 views

Which browsers allow users to reveal passwords in password fields?

Which browsers allow users to reveal passwords in password fields? I already know that Windows 8, Windows 8.1, Internet Explorer 10 and Internet Explorer 11 (1). Cursory research did not reveal any ...
44
votes
10answers
3k views

What is the best way to inspire users to choose strong password?

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be ...
4
votes
1answer
96 views

Forgot password— show the rules for that passphrase? [duplicate]

I know there's been a lot of discussion about password strength and indicators when signing up. I often find that when I forget a password for a site, its because I can't remember which set of rules ...
32
votes
5answers
4k views

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
16
votes
6answers
1k views

Why do users erase all the password when they hit one wrong key, instead of just the last wrong character?

We login to applications almost every day. The password is stored in our fingers, as an automated process (if they have used it long enough). When users realize they have entered a wrong character ...
3
votes
3answers
132 views

Is it a bad idea to not allow users to register with an easy to guess password?

We all know them: password, password123, and letmein are all fairly common passwords and are easy to guess. Still, people use them. Would it be a bad idea to not allow users to use common passwords? I ...
3
votes
2answers
249 views

Show a password strength indicator without text?

Do people know what it means when there is a coloured bar that shows up below their password as they type? The users that will be using this form will be from all over the world and most likely ...
0
votes
1answer
83 views

Forgotten username, password or both

I am having some trouble with the wording of the following: Forgotten your Username or Password? Both? Where Username, Password and Both are links. Is there a need for the Both option or ...
1
vote
3answers
162 views

Best way to handle email verification before checking the user's password?

I'm creating an online service that requires users to sign in with their email address, and before they can sign in on a new device, they have to confirm it with an email message in their inbox. The ...
6
votes
9answers
580 views

Should password be set by users without security check?

I'm guessing if I should let my users choose their password without checking if there's at least 1 $pecial charact€r, 1 CAPLOCK, 1 numb3r... Shouldn't we just ask users to put a minimum of X ...
16
votes
7answers
2k views

Are there numbers and letters to avoid for activation codes via SMS?

We are at a fairly early stage in our application development and have run into a usability issue related to typing an activation code sent via SMS into a browser URL. Here's the basic scenario: ...
9
votes
9answers
450 views

barebone registration: is password repitition and captcha really essential?

If you design a barebone registration form which only requires email address and password as essentials can you omit the password repetition and captcha without too much technical trouble? I ...
3
votes
6answers
485 views

How to present password rules

How should feedback be given about password rules in registration forms? a) When you focus on the password field b) When you type the first letter of the password c) When you stop typing, plus a ...
0
votes
2answers
133 views

Form for admins to to create users: include option for setting password or sending email to user so user can set their own password

I am creating a form that will allows dealers of my company's product to create user accounts for their customers. When creating a new account, they can either set the password with the form, or have ...
4
votes
2answers
183 views

Strategy for making easy remembered, easy typed and secure password for mobile devices?

I make great passwords which I remember in my fingers when I'm on a laptop keyboard. But when I turn to mobile devices, I lose my muscle memory on the soft keyboard. To overcome this problem, I store ...
1
vote
1answer
63 views

What is an example of a mobile app using an eye icon for showing the password in clear text

I am seeking an example to use in the 2nd Edition of the Mobile Design Pattern Gallery, O'Reilly Media 2014, but I cannot find the example I thought I had on hand. Can you think of any?
8
votes
3answers
730 views

Usability and security for user access and password handling in a web application?

I'm looking at putting together a website aimed at ordinary users that will handle personal data which I don't want to be compromised. How can I make the site secure but also usable? It seems most ...
2
votes
2answers
199 views

Remember Me in an enterprise application: What to remember?

I've just finished a well-thought login validation mechanism and have asked myself the following question several times: What does the user expect when he checks the Remember me checkbox in an ...
1
vote
1answer
103 views

Password protected content / Modal dialog or submission form up-front?

I'm working on a page, where a portion of the information is going to be protected by a password. Would it be beneficial to have text that says "Please enter password to view content" right up front ...
1
vote
1answer
679 views

Prevent Active Directory password expiration when user never logs in

Let's assume the following in a hospital: Each nurse has her own Active Directory user, with a password. The password expires automatically 90 days after the password was set. A nurse uses her own ...
2
votes
6answers
740 views

Is it necessary to verify a user's email address?

It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code. Is it really necessary to do this ...
1
vote
2answers
204 views

Password confirmation vs. email confirmation

Is it more advisable to ask a confirmation to the email or a confirmation to the password in a website registration form? I'm asking this because I saw this blog post that was featured on Hacker News ...
3
votes
2answers
180 views

What is the recommended time before a reset password link expires?

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset ...
0
votes
3answers
197 views

How should I show a password exists on an edit password form?

We're salting + hashing all of our passwords, but we allow the user the option to edit his/her password. However, we cannot retrieve the password to put the proper amount of asterisks into the ...
1
vote
1answer
61 views

Should a password change/reset log you out remotely?

I have a app with multiple frontends. (Web/Android/iOS). If you do a password reset/change at one of the frontends, should it log you out of other places? I don't want to make things hard for users, ...
40
votes
7answers
1k views

Designing a password/authentication system usable for young children in a classroom

We are all familiar with the best password practices for websites which will be used by adults, such as storing passwords in one-way hashes, using password resets instead of emailing password, etc. ...