2

I have seen some services ask the user to create a password on the initial signup form.

I have seen others only ask the user to create a password after clicking on a verification link sent to their email address.

Which is best, and why?

Improve this question

3 Answers 3

Reset to default
3

Remember that you're always balancing your business needs against users' needs, so create as few barriers to entry as you can get away with.

  • If it's possible for users to engage with your site without creating an account or logging in at all, then let 'em: they'll appreciate you for it, and when it's time to gain additional value from your site with an account, they'll be in a mood to do so.

  • Once they have decided to sign up, ask for as little information as possible: email address (which can serve as their username, provided that it's not displayed, to avoid spammers scraping your site), optional username (if and only if it's valuable to the user to have an identity on your site) and password (without making them type it twice, for Krum's sake!).

  • Later, if you need more information to deliver further value, then (and only then) can you ask for it.

  • Finally as @Perchik says in his trenchant comment to @Nick_M's answer, don't force them to sign in once they've already given you their email and password (and, possibly, a username), even if you have to go through an email verification loop: they've paid the price of admission already, so let 'em in right away.

Improve this answer
4
  • 1
    I disagree with the parenthetical "without making them type it twice". If you show their password when they create the account, then they don't need to enter it twice. If you hide it (seems to be default) then having them only enter it once is prone to typos.
    – Perchik
    Commented May 29, 2014 at 21:02
  • 1
    That's easily solved: stop hiding passwords. It doesn't improve security, it annoys users, and it is costing you money in lost logins[1]. Masking and making users type it twice is user-hostile: "Here: type an obscure character string twice, exactly alike, making no mistakes, without being able to see what you're doing." [1] nngroup.com/articles/stop-password-masking
    – Dave Land
    Commented May 30, 2014 at 6:49
  • (I thought about asking the followup question of "why do we hide passwords" :)
    – Perchik
    Commented May 30, 2014 at 12:33
  • It's a good question! I think we mask passwords because it seems like the right thing to do. Passwords are important! We mask them for the same reason that nobody posts pictures of their credit/debit cards online (oh, wait, they do: twitter.com/NeedADebitCard). Here's one company's explanation of why they stopped masking passwords at creation time: umbraco.com/follow-us/blog-archive/2014/4/8/…
    – Dave Land
    Commented May 30, 2014 at 20:39
1

You should have the user get as much of the necessary information the site needs out of the way quickly. It is better UX practice to have them create their password when they sign-up and then send a verification e-mail.

I could see users getting frustrated having to jump from sign-up to e-mail to password creating. It is more efficient to have them fill out username/password on the sign-up and then receive an e-mail verification which re-directs them to their account information after which they can edit if they wish to. Just a suggestion, hope it helps.

Improve this answer
3
  • 3
    and for pete's sake, after they create their email/password combo, don't make them log in again.
    – Perchik
    Commented May 29, 2014 at 18:56
  • I disagree with this. You should ask the user for as little as possible up front. You want to reduce hurdles--not make a large one. Granted, lots of places do ask you for a password from the get-go, but if there's a way to get them into the site without having to do it immediately, it could be a good approach.
    – DA01
    Commented May 29, 2014 at 19:51
  • If you need to login to a site, which this one obviously does than you have to have a password to go along with the username. If he didn't need a password at all then this would not be an issue for him. @DA01
    – Nick_M
    Commented May 30, 2014 at 0:46
0

I would think its best to ask for a password at the same time as asking for a username and/or email address. This way, the user can (hopefully) log in with their password, AND be able to recover their password via email, if needed.

If you only ask for (or provide) a password during/after the email confirmation, you completely cut off the user in the event of a typo in their email address.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.