I am just creating a registration form for my website. However, I can't decide wether to go the secure or the user-friendly way.

I've got two options:

The used password must fit into a pattern

This is the secure option. The pattern would consist of a password with a minimum length of, like 10 characters, a number and an uppercase letter.


  • Secure. The password can't be found out that easy.


  • The user might forget the password because he can't use his usual password. This can lead to frustration and the user might not want to come back.
  • The user might get frightened away because he knows he will forget such a password. And so the Conversion Rate drops down.

Free choice for the user

The user-friendly option. The only specification of the password would be a length of, like 6 Characters. Everything can be done as the user want's.


  • The user can use a password he knows and he can remember.


  • Insecure. Hackers can easily start a dictionary-attack and can be successful.


I could first let the user make the registration only by typing in his name and email. When he clicks on register I could do something "user-binding". After that I ask for a password with a pattern. The user now already made some efforts and he might not leave the site immediately, also knowing his email is already registered and he is just before getting his account.

I also could watch out for often used passwords like 123456 or something similar and block them. By doing that, dictionary attacks by "hackers" can be prevented more or less.

It would be nice to hear your opinion on that. Thanks!

  • 1
    I'm probably not the only one who just throws on "A1!" at the end of the password if a website has silly password requirements. My passwords are usually >20 characters, XKCD style, with at least one invented word.
    – user69458
    Commented Apr 24, 2017 at 22:15

2 Answers 2


It's not necessarily true that your password pattern is more secure. Difficulty in brute forcing the password increases exponentially with each character, not as much with strange password requirements. I think websites should only enforce a large minimum length, like 14 or 16 characters, but place no other restrictions on the passwords. This is the "best of both worlds" since users can use short sentences or other things that are easy to remember but the length makes it very difficult to hack.

XKCD makes the argument quite well: enter image description here

  • The problem with a large minimum length is users who use a password manager. Having to change the password generator settings to appease the site's requirements is frustrating when I know my password already has >100 bits of entropy. Commented Apr 25, 2017 at 9:47

I suspect that there is more to think about than just the possibility of a "hacker" doing a dictionary-attack, although this entry on StackOverflow gives useful details.

You might also want to think about two-factor authentication, or even three-factor if the application warrants it.

As J. Dimeo suggests, password patterns aren't really that useful and tend to give a false sense of security. They are also extremely annoying sometimes.

Personally, I recommend allowing a pass phrase, rather than a strict pattern. For example, "Run you clever boy and remember" is much easier to deal with that "Tr0ub4dor&3" to borrow the XKCD example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.