A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

93
votes
11answers
14k views

Why should we ask the password twice during registration?

It would be easier to ask for a user's password only once during registration. The problem: The user could make a mistake while typing the password once because of hiding letters. The solution: The ...
67
votes
14answers
10k views

Is a “repeat password” field necessary in a signup page? [duplicate]

Possible Duplicate: Why should we ask the password twice during registration? When designing a new and simplified signup page I got into an argument with a colleague about the necessity of ...
44
votes
10answers
3k views

What is the best way to inspire users to choose strong password?

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be ...
10
votes
5answers
2k views

Is only having a single unmasked password field (no confirm) on a registration page a bad idea?

Some sites allow you to register and only provide a single password box, which is protected with stars. Traditionally a "confirm password" box is used when registering which allows you to confirm ...
19
votes
3answers
1k views

Should password fields have an unmask checkbox?

Is it a good idea to have an unmask checkbox for user selection when the users type their password to show them what they typed?
34
votes
5answers
4k views

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
9
votes
9answers
482 views

barebone registration: is password repitition and captcha really essential?

If you design a barebone registration form which only requires email address and password as essentials can you omit the password repetition and captcha without too much technical trouble? I ...
6
votes
5answers
813 views

Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
5
votes
3answers
2k views

How to show password reset option

In my website I put password recovery option hidden. I know there are two options to deal with it. Classical way, Show it as the next sentence to the register link. Example, "Want to try? Sign up ...
16
votes
2answers
904 views

Should we send both username and password after registration?

After users have registered on a website, should that website send both username and password in their registration confirmation email ?
17
votes
7answers
3k views

Are there numbers and letters to avoid for activation codes via SMS?

We are at a fairly early stage in our application development and have run into a usability issue related to typing an activation code sent via SMS into a browser URL. Here's the basic scenario: ...
8
votes
3answers
802 views

Usability and security for user access and password handling in a web application?

I'm looking at putting together a website aimed at ordinary users that will handle personal data which I don't want to be compromised. How can I make the site secure but also usable? It seems most ...
4
votes
7answers
1k views

Is it good user experience to only require an email address at signup?

Is it a good idea to only require an email address from users at signup (without a password or other details)? After they sign up, we will send a random password to their email address; this password ...
25
votes
6answers
1k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
10
votes
4answers
929 views

Should we disallow common passwords like “password” and “12345”?

Studies show that people can use some really "insecure" passwords. Here's Mashables worst 25 passwords of 2011 for example. To protect security on our sites (and the overall experience of less-hacked ...
3
votes
6answers
1k views

Is it necessary to verify a user's email address?

It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code. Is it really necessary to do this ...
3
votes
6answers
522 views

How to present password rules

How should feedback be given about password rules in registration forms? a) When you focus on the password field b) When you type the first letter of the password c) When you stop typing, plus a ...
16
votes
6answers
1k views

Why do users erase all the password when they hit one wrong key, instead of just the last wrong character?

We login to applications almost every day. The password is stored in our fingers, as an automated process (if they have used it long enough). When users realize they have entered a wrong character ...
14
votes
6answers
1k views

Password field in cleartext

I'm building a mobile web app that will request a bunch of information from the user (name, dob, address, etc) and am trying to cut down as much fields as I can. I've noticed a new trend where mobile ...
13
votes
5answers
1k views

Should I let a user copy/paste into a confirm e-mail field for a registration form? [duplicate]

Possible Duplicate: Preventing a user from pasting from the clipboard into a mandatory form field There was a question of stackoverflow, that a programmer did not wont to let the new users ...
2
votes
2answers
233 views

Remember Me in an enterprise application: What to remember?

I've just finished a well-thought login validation mechanism and have asked myself the following question several times: What does the user expect when he checks the Remember me checkbox in an ...
11
votes
5answers
2k views

Pros and Cons for having same form for login, register and forgotten password

I have notice some sites have the same form for login, register and forgotten password. Below the form you have 3 buttons i forgot my password register log me in What are the pros and cons on ...
9
votes
3answers
889 views

Should password fields be blanked when inline validation fails?

This question with a similiar name refers to registration, but in my case, I would like to address submission. My use cases are: A login form consisting of a email address. A change password form ...
7
votes
3answers
76 views

Accessing secure content

Which of the permutations for accessing secure content do folks prefer? In this instance I'm referring to a saved quote and have usernames, email addresses and quote reference numbers available. ...
6
votes
3answers
348 views

What would be an expected behaviour for resetting the password?

When a user uses the »I forgot my password« link several times and gets a couple of emails, each one with a tokenized link to reset his password, what would be the appropriate behaviour? All links ...
4
votes
4answers
416 views

Forgotten passwords - should the temporary password expire?

Just designing the forgotten password form for a retailer. When researching other retailers, I've have noticed the temporary password link that gets sent to inbox's expire after a few hours. What is ...
2
votes
3answers
141 views

Forcing Users To think up More Complex Passwords / Ease of Remembering Them

Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have ...
1
vote
1answer
84 views

What is a Design pattern for “Remember Me” that forces user to explicitly choose “remember” or "do not remember?

We have a very nontechnical user base. We provide a "Remember Me on this computer" option (checked by default) but perhaps it should not be checked by default. However, I want to make sure they have ...