I am trying to decide which is the best way to display the password rules when a user is changing their password.

There are approximately 4 important password criteria.

Option 1: Place criteria in tooltip, visible when New Password field is focused

Criteria in tooltip

Option 2: Show criteria above field, visible always

Criteria above field

  • 1
    I think the two images can't be directly compared, as Option 1 shows 5 criteria, while Option 2 shows 8. Because of this, Option 2 might be unfairly critiqued. May 14, 2018 at 14:47
  • 2
    Have you considered to reduce the criteria numbers ? Studies have proven that the length is enough to strenghened a password more effectively than imposing various characters.
    – Renaud
    May 16, 2018 at 12:36

3 Answers 3


Option 1 is a much cleaner solution that what is displayed in the graphic above. And option 1 is a good space saver.

I would recommend changing the white circles next to each line of requirement to a greyed out check mark or something similar to this as at first sight I confused it with a radio button. a green check mark would appear when the requirement has been full-filled.

I would presume that the popup in option 1 would be dynamic and check marks would appear as the user puts in his new password.

Maybe a show password option would be useful for this growing trend of complicated long passwords.

tldr: option 1 good, screenshot above not efficient use of space.

  • Thank you, but I am still asking myself if is a good idea to keep the rules hidden until the new password is tapped.
    – gm1995
    May 14, 2018 at 9:49
  • 1
    @gm1995 - Yes, it is a good idea to keep the rules hidden until the user has selected the password field: this keeps the visual clutter to a minimum, and does not present any information that is not needed for what the user is doing at that moment. May 14, 2018 at 11:35
  • 1
    exactly, it will simply confuse the user if it's always displayed. Why should the user read about password requirements when he has to think of a user new for example. each step on its own.
    – Boris G
    May 14, 2018 at 14:53

It might be worth noting that Bill Burr, the person who recommended these bizarre password rules has recently changed his mind and admitted that they are not a good idea.

Then, there's always this classic Password Strength piece, which is likely the most cited reference on the matter.

  • Thanks, I am looking there. Only one question, how the new rule is going to perform for mid-age people?
    – gm1995
    May 17, 2018 at 7:06
  • @gm1995 Hard to know, as I'm not aware of any specificresearch. However, anecdotal evidence suggests that complex passwords are useless and often written down. I suspect that the only reason Post-It notes are still being manufactured is to allow people to wirte down their passwords and store them in their desk. May 17, 2018 at 7:26

It seems tidy, but so crowded, so option 1 is kind of a good solution. Also you can try to hide the rules. Before the user touches the "new password" area we won't see the rules. After the user touches the area the rules can appear.

  • yea that was the idea, they are going to see the rules only when they tap on new password, BUT, is it a good practice to keep them hidden?
    – gm1995
    May 14, 2018 at 9:48
  • I think so, they will see the rules when they need.
    – duto
    May 14, 2018 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.