A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

88
votes
11answers
12k views

Why should we ask the password twice during registration?

It would be easier to ask for a user's password only once during registration. The problem: The user could make a mistake while typing the password once because of hiding letters. The solution: The ...
65
votes
14answers
9k views

Is a “repeat password” field necessary in a signup page? [duplicate]

Possible Duplicate: Why should we ask the password twice during registration? When designing a new and simplified signup page I got into an argument with a colleague about the necessity of ...
44
votes
10answers
3k views

What is the best way to inspire users to choose strong password?

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be ...
10
votes
5answers
2k views

Is only having a single unmasked password field (no confirm) on a registration page a bad idea?

Some sites allow you to register and only provide a single password box, which is protected with stars. Traditionally a "confirm password" box is used when registering which allows you to confirm ...
33
votes
5answers
4k views

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
19
votes
3answers
1k views

Should password fields have an unmask checkbox?

Is it a good idea to have an unmask checkbox for user selection when the users type their password to show them what they typed?
9
votes
9answers
458 views

barebone registration: is password repitition and captcha really essential?

If you design a barebone registration form which only requires email address and password as essentials can you omit the password repetition and captcha without too much technical trouble? I ...
5
votes
3answers
2k views

How to show password reset option

In my website I put password recovery option hidden. I know there are two options to deal with it. Classical way, Show it as the next sentence to the register link. Example, "Want to try? Sign up ...
5
votes
5answers
760 views

Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?

On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
16
votes
2answers
872 views

Should we send both username and password after registration?

After users have registered on a website, should that website send both username and password in their registration confirmation email ?
16
votes
7answers
2k views

Are there numbers and letters to avoid for activation codes via SMS?

We are at a fairly early stage in our application development and have run into a usability issue related to typing an activation code sent via SMS into a browser URL. Here's the basic scenario: ...
23
votes
6answers
1k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
4
votes
7answers
1k views

Is it good user experience to only require an email address at signup?

Is it a good idea to only require an email address from users at signup (without a password or other details)? After they sign up, we will send a random password to their email address; this password ...
10
votes
4answers
854 views

Should we disallow common passwords like “password” and “12345”?

Studies show that people can use some really "insecure" passwords. Here's Mashables worst 25 passwords of 2011 for example. To protect security on our sites (and the overall experience of less-hacked ...
2
votes
6answers
850 views

Is it necessary to verify a user's email address?

It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code. Is it really necessary to do this ...
16
votes
6answers
1k views

Why do users erase all the password when they hit one wrong key, instead of just the last wrong character?

We login to applications almost every day. The password is stored in our fingers, as an automated process (if they have used it long enough). When users realize they have entered a wrong character ...
14
votes
6answers
941 views

Password field in cleartext

I'm building a mobile web app that will request a bunch of information from the user (name, dob, address, etc) and am trying to cut down as much fields as I can. I've noticed a new trend where mobile ...
13
votes
5answers
1k views

Should I let a user copy/paste into a confirm e-mail field for a registration form? [duplicate]

Possible Duplicate: Preventing a user from pasting from the clipboard into a mandatory form field There was a question of stackoverflow, that a programmer did not wont to let the new users ...
9
votes
3answers
838 views

Should password fields be blanked when inline validation fails?

This question with a similiar name refers to registration, but in my case, I would like to address submission. My use cases are: A login form consisting of a email address. A change password form ...
7
votes
3answers
73 views

Accessing secure content

Which of the permutations for accessing secure content do folks prefer? In this instance I'm referring to a saved quote and have usernames, email addresses and quote reference numbers available. ...
6
votes
3answers
313 views

What would be an expected behaviour for resetting the password?

When a user uses the »I forgot my password« link several times and gets a couple of emails, each one with a tokenized link to reset his password, what would be the appropriate behaviour? All links ...
4
votes
4answers
336 views

Forgotten passwords - should the temporary password expire?

Just designing the forgotten password form for a retailer. When researching other retailers, I've have noticed the temporary password link that gets sent to inbox's expire after a few hours. What is ...
2
votes
2answers
102 views

Forcing Users To think up More Complex Passwords / Ease of Remembering Them

Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have ...