A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.
61
votes
11answers
6k views
Why should we ask the password twice during registration?
It would be easier to ask for a user's password only once during registration.
The problem: The user could make a mistake while typing the password once because of hiding letters.
The solution: The ...
58
votes
14answers
5k views
Is a “repeat password” field necessary in a signup page? [duplicate]
Possible Duplicate:
Why should we ask the password twice during registration?
When designing a new and simplified signup page I got into an argument with a colleague about the necessity of ...
42
votes
17answers
5k views
Computer login with password only, without username
I have an idea to simplify the login screen on things like home computers with a small number of users (say, 2-10) with passwords.
Today, a typical home computer's login screen has three steps:
...
42
votes
10answers
2k views
What is the best way to inspire users to choose strong password?
Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be ...
34
votes
11answers
3k views
Is “Never tell your password to anyone” message in chat really necessary?
In almost every chat window I open, there's this fairly obvious statement:
Never tell your [password/credit card/social security/etc] to anyone.
Are there some standards for chat functionality that ...
21
votes
6answers
874 views
Forcing users to use a particular pattern for passwords
Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
16
votes
4answers
1k views
Should I trim spaces in passwords?
The problem is that we send a user an email with a generated password if they forget.
If they choose to cut and paste it in, then Outlook typically adds a " " to the end of it.
When they paste it ...
16
votes
3answers
368 views
Should password fields have an unmask checkbox?
Is it a good idea to have an unmask checkbox for user selection when the users type their password to show them what they typed?
15
votes
5answers
883 views
Should I use two steps or one when users change password?
I currently have a page dedicated to changing passwords. There are 2 options:
A 2 step option:
download bmml source – Wireframes created with Balsamiq Mockups
download bmml ...
15
votes
2answers
680 views
Should we send both username and password after registration?
After users have registered on a website, should that website send both username and password in their registration confirmation email ?
14
votes
4answers
341 views
Is it good UX practice to have a website generate a password for the user?
Is it good UX practice to have a site generate secure random passwords for users and send it to their email or is it better to have them enter their own one each time?
13
votes
7answers
951 views
Are there numbers and letters to avoid for activation codes via SMS?
We are at a fairly early stage in our application development and have run into a usability issue related to typing an activation code sent via SMS into a browser URL.
Here's the basic scenario:
...
13
votes
6answers
621 views
What is the best way to request individual characters from a password?
Frequently, sites that should really value security (especially banks) ask for several individual characters from a password.
Typically I've seen them do it like this:
download bmml source ...
13
votes
6answers
717 views
Password field in cleartext
I'm building a mobile web app that will request a bunch of information from the user (name, dob, address, etc) and am trying to cut down as much fields as I can.
I've noticed a new trend where mobile ...
12
votes
5answers
752 views
Is it appropriate to display the warning message “Caps Lock is on”?
Is it appropriate to display the warning message "Caps Lock is on" when focus shifts to Password field?
In gmail and yahoo I don't find. So, what does the standard says?
11
votes
5answers
785 views
Should I let a user copy/paste into a confirm e-mail field for a registration form? [duplicate]
Possible Duplicate:
Preventing a user from pasting from the clipboard into a mandatory form field
There was a question of stackoverflow, that a programmer did not wont to let the new users ...
10
votes
5answers
731 views
Why do users erase all the password when they hit one wrong key, instead of just the last wrong character?
We login to applications almost every day. The password is stored in our fingers, as an automated process (if they have used it long enough). When users realize they have entered a wrong character ...
10
votes
9answers
2k views
What is an easier unlock pattern: gesture or code?
There are two popular ways to unlock a phone. iPhone makes you type in a numerical code. Android gives you the option to draw a gesture. Which of these two is easier to remember and easier to execute?
...
10
votes
2answers
328 views
Email confirmation on password reset?
I am building a prototype to a system that has a user account system in place. Of course with any account system, the user should be able to reset their password should the need arise (e.g., ...
9
votes
9answers
344 views
barebone registration: is password repitition and captcha really essential?
If you design a barebone registration form which only requires
email address and password as essentials can you omit the password repetition and captcha without too much technical trouble?
I ...
9
votes
3answers
617 views
Should password fields be blanked when inline validation fails?
This question with a similiar name refers to registration, but in my case, I would like to address submission.
My use cases are:
A login form consisting of a email address.
A change password form ...
8
votes
5answers
837 views
Is only having a single unmasked password field (no confirm) on a registration page a bad idea?
Some sites allow you to register and only provide a single password box, which is protected with stars.
Traditionally a "confirm password" box is used when registering which allows you to confirm ...
8
votes
4answers
632 views
Should we disallow common passwords like “password” and “12345”?
Studies show that people can use some really "insecure" passwords. Here's Mashables worst 25 passwords of 2011 for example. To protect security on our sites (and the overall experience of less-hacked ...
8
votes
4answers
1k views
Pros and Cons for having same form for login, register and forgotten password
I have notice some sites have the same form for login, register and forgotten password.
Below the form you have 3 buttons
i forgot my password
register
log me in
What are the pros and cons on ...
8
votes
3answers
300 views
“Remember my password” and “Sign in automatically” on tablets
Is there a need to have "Remember Me" and "Sign in automatically" on mobile devices, especially for tablet based applications? Skype, Fring on iPhone/Android seems to not to have these options, ...
8
votes
6answers
356 views
How to handle “forgot password” when user has not confirmed email?
If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very ...
8
votes
2answers
98 views
Why do most Create Account forms clear the password fields upon wrong validation? [duplicate]
In most Create Account forms that I've used, when you enter in something wrong (username not long enough, passwords don't match, invalid email, etc.), it'll keep all the fields but erase the password ...
8
votes
2answers
150 views
Website registration/login process with highest success rate? [duplicate]
I'm looking for data about how to implement a registration and login process for a new website. We are currently considering four options:
Login with email address and password that is stored in ...
7
votes
4answers
756 views
Social Login adoption vs Traditional Login
I have implemented janrain's social login on my website. I am wondering how important it is to include a traditional login (email/password) system.
I believe there may be a significant percentage of ...
6
votes
4answers
812 views
Any usability studies on password strength meters?
I put together a password strength meter for a signup form, and overall it works very well. It hooks into our DB for the "rules" (number of characters required, mix of letters and numbers, etc.), and ...
6
votes
3answers
126 views
What would be an expected behaviour for resetting the password?
When a user uses the »I forgot my password« link several times and gets a couple of emails, each one with a tokenized link to reset his password, what would be the appropriate behaviour?
All links ...
6
votes
3answers
50 views
Accessing secure content
Which of the permutations for accessing secure content do folks prefer? In this instance I'm referring to a saved quote and have usernames, email addresses and quote reference numbers available.
...
6
votes
3answers
434 views
Usability and security for user access and password handling in a web application?
I'm looking at putting together a website aimed at ordinary users that will handle personal data which I don't want to be compromised. How can I make the site secure but also usable?
It seems most ...
6
votes
3answers
160 views
On log in form, what should a password unmask button look like and say?
On the log in form, I want to give users the option to unmask the password field so they can see what they type. The phrase "unmask password" is too technical and its purpose may not be apparent to ...
6
votes
2answers
248 views
Should we require confirmation before resetting a password?
If a user has forgotten their password for a service, the convention is that they should need only their username and/or registered email address in order to reset their password -- in our case that ...
6
votes
1answer
138 views
Sign-in Methods for Visitors without Social Networking Profiles
If a visitor needs to sign-on at your site and they don't have any social profiles, their only option is to use a traditional (double opt-in) registration process. That is why websites should always ...
5
votes
5answers
495 views
Forgotten Passwords - is there a real benefit to asking for memorable password hints on signup?
On several signup forms I see fields such as "Choose your Memorable Password Question". Is this actually benifical nowadays? Surely a more secure method if someone forgets their password is to build a ...
5
votes
3answers
905 views
How to show password reset option
In my website I put password recovery option hidden. I know there are two options to deal with it.
Classical way, Show it as the next sentence to the register link. Example, "Want to try? Sign up ...
5
votes
2answers
296 views
How should the sign-up page for a mobile website work?
How should the sign-up page for a mobile website be?
For example:-
Does repeat password make more sense or less on mobile version of a website. To put it differently, are users more prone to make a ...
5
votes
3answers
450 views
Should my app send a confirmation email on user registration?
I'm grappling with the user registration experience for my application.
I'm considering this model:
User enters...
Username
Password
Password confirmation
Email address
The app displays a ...
5
votes
2answers
164 views
Password and in place editing
I decided to support in place editing for a simple user table.
I am not sure what i should do about password...
When i create a new user i can have a textbox to type...
When viewing i can hide then ...
5
votes
1answer
174 views
Usable examples, recommended practices for interfaces optimized for using pass-phrases instead of passwords
Reading through What is the best way to inspire users to choose strong password?, I realized I have never used an interface where the primary login password system would use pass-phrases (and where ...
5
votes
2answers
63 views
Masked password characters in a GUI vs terminal
In a GUI form, or for example a login box on a website, it's usual for masked characters to appear like ********* as you type out your password.
But in terminal applications, for example ssh, this ...
5
votes
4answers
729 views
Why do sites split 'password' and 'username' retrieval into two separate operations?
I find this way of doing it highly annoying when I come back to a site I haven't used in a while. First having to enter my email to get my username and then enter my username and email to reset my ...
5
votes
2answers
417 views
Best practice for overriding a pincode in a native iOS app?
I am working on the next version of an existing iPad app which has a pincode to lock admin functions. The current version has no means to override the pincode. We followed similar patterns and use ...
4
votes
7answers
766 views
Is it good user experience to only require an email address at signup?
Is it a good idea to only require an email address from users at signup (without a password or other details)? After they sign up, we will send a random password to their email address; this password ...
4
votes
3answers
287 views
What solutions do you use to host html prototypes for your clients [closed]
I have been using a basic hosting service to host html prototypes for clients. I have realized that I need a solution that can offer me greater control e.g. to allow me to set master passwords for all ...
4
votes
1answer
84 views
Encryption of chat messages and possibility of password loss
I have a client-server chat like app. I would like to add an encryption of messages for users. So, that they will be sure that no one, even service owner, can read their confidential information. I'm ...
4
votes
2answers
214 views
Forgot Password Alternatives?
Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords.
Our current ...
4
votes
1answer
818 views
iPhone App: Best practice for sign in with password recovery?
I'm in the process of wireframing an iPhone App for a big website with some functions that can only be used by signed in users (e.g. favorites, saved searched).
Many apps use the modal dialog to ...
