When changing password we usually see these fields:

  1. Old Password
  2. New Password
  3. Confirm New Password

But personally I think "Current Password" is clearer in telling the user that we need their current password to authorise the changing, negating the possibility that they might think the previous password is required(I have witness people being confused by this before).

So my question is the more common 'Old Password' more comprehensive than 'Current Password' or any other wording for it? If so how? and if not why is it used more widely?

  • 2
    For what it's worth, "current password" is the phrasing used widely. – Alan Aug 18 '17 at 12:46
  • Maybe I have been using apps and sites made earlier... – Ben Ong Aug 18 '17 at 16:00
  • Using the word old is helpful to the user as it is clear distinction that it is not the new password they are creating. Using the word current is ambiguous because during this transaction the current password will change from the old to the new. By using current you add cognitive load on the user to determine which is which. If the user mis-types their old password they'll get an error before submitting which tells them their "current password is wrong"... contextually at this point current is weird because if they had succeeded their new password would have been the current password. – scunliffe Aug 19 '17 at 11:49

A two-step approach to changing passwords eliminates the need to use either term (see below). However, if you're going to use a single-form approach, I'd recommend "current" as it's more accurate.

Google uses a two-step approach to changing password. First, they ask for "your password":

enter image description here

Then, after verifying your password, they ask for your new password (with a confirmation):

enter image description here

If you're going to stay with a one-screen approach, I would recommend using "Current password" since at the time the user enters this password it's their current password, not their old password. This is the approach and terminology used by both Facebook and Twitter (among others).

Confirmation and/or a "Show password" toggle

Google, Facebook, and Twitter all make you confirm/retype your new password when completing a password change. Only Google has a toggle to show the password you've just typed. The more I read and think about password fields, the more I'm convinced that including a "Show password" link or checkbox should be included in password fields.


I think if you do more storytelling during this process the problem will dissolve.


  • Need a new Password?
  • Enter your new password:
  • Reenter the new password (to avoid typos):
  • To make sure it's you, please enter the current password for the last time:

Perhaps it's a little too much in this example - but you get the idea. Customer Experience is more than just 3 fields, a button and a short description. Depending on your product - this process could be a fun and authentic one!

  • You need to be careful my password manager didn't just update the password, which causes me to have suddenly "forgotten" the old password. – Jasper Aug 18 '17 at 10:05
  • This would be pretty confusing. I just entered a new password, now it's asking for my "current" password -- does that mean the old one or the new one I just made current? It's sort of hinted at by the "for the last time" but requires a pretty close reading of the text to suss out what's intended. (It also reverses the order of a common and familiar pattern, which while not always the wrong decision at least requires a clear justification...) – Daniel Beck Feb 15 '19 at 13:25

Let's look at a couple of situations where this activity would be needed -

  1. If the existing password has expired - In this case, it would make sense to say, "Old Password" as the intention is to make it clear that the password has expired, hence, is old.
  2. If the user intends to change the password - IMO, it makes more sense to use the word, "Current Password" as the user can always cancel this activity and still retain the password. The password, isn't old or expired, but very much the current one, unless this activity is processed successfully.

Hence, IMO, usage of the word could help the context and should be based on that - rather than on generic patterns. Said that, I also liked the two-step process that Jonathan mentioned earlier, but I do understand that it might not be possible always.

Not the answer you're looking for? Browse other questions tagged or ask your own question.