Some apps have keyboards suggestion bar, like on the picture below, enabled on password fields.
Is it a good UX or security practice to have suggestions while typing existing or creating a new password?
3 Answers
It’s a bad practice for security reasons:
If a user types in the password, a bystander could take a quick look. It’s way easier to read a suggestion than to follow the keys the user enters. While the suggestion is not necessarily correct, it might be close enough.
Many keyboard suggestion implementations learn what the user types often. This might give attackers helpful hints to crack the password.
For security reasons the suggestions bar should always be hidden when typing passwords, as @unor writes. Also it will definitely cause users to submit wrong passwords, or have to retype them when they accidentally hit a suggestion. So more a annoyance than help.
Instead a view password option on the password field could be implemented.
When would it help? If your password is a correct word, and you spell it wrong. When would it be unhelpful? If your password is not a correct word, but close enough for the spelling checker to fix it, or to make suggestions which will be wrong.
Since people usually don't use correct words as passwords, it's usually not helpful. Especially if a password is not visible, it is highly likely that spelling suggestions make it a lot harder to enter a password correctly. What's worse is when the user wasn't sure which password to use (is it password X or password Y), and they think they typed in X which was then modified by these suggestions, then the experience can become very frustrating.
