So, after browsing other threads, I found some information on the question of when a user is logging in, and fails to authenticate do we give the user the message "Username or Password is incorrect" or can we specifically say "No account with that username" and "Password is Incorrect". I found there is no security threat if we give the more specific error message (as malicious users can typically find the usernames/emails through a service's through the registration and password recovery processes anyway) and giving the specific message provides the user a much better experience.

Unfortunately, it doesn't seem like the organization will get on board with this unless I have some data to back it up. SO MY QUESTION IS, are there any studies done about the benefit of telling the user specifically that it was their password that they got wrong? If not, any ideas on how I could create a prototype to specifically test for this and get organic results? It just makes it hard to test because you can't organically have someone mistype or forget their username/password. Any help on how I would get some data/proof to back this up would be helpful! Thank you!

1 Answer 1


The short answer is - yes. But there is no actual research in open access, however there is a range of material that contains some of this information.

Some research based information available here: https://conversionxl.com/blog/password-ux/ https://conversionxl.com/blog/error-messages/

You might find this useful: https://freshsparks.com/user-experience-tips-best-error-messages/ https://uxplanet.org/how-to-write-a-perfect-error-message-da1ca65a8f36 https://www.nomensa.com/blog/2010/four-ways-display-error-messages-and-improve-ux

You can also find some useful information here.

In order to get some accurate data, you can implement an extra field in your password reset form which would prompt users to try their password once again before resetting the password. Something like "Hey, let's try again before we get you a new password!". If the password is correct, before continuing you can show user a one question survey i.e. "How did this happen" and answers like "I don't know, I must have missed a key", or "Something reminded me of a correct password" etc.

You can also count the amount of times they tried their password. This will give you some extra data.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.