Is it good to create a separate screen for change password?

Question

I have a web-page to create a new user; Now, I want to use the same page for editing the user's profile. Is it good to use the same page for change password? OR do I have to create a separate page, which asks for the old password and so on?

I think a separate page is the old way. The new trend is to use the same screen, and if the password is blank that means "no change in password", otherwise it is updated.

Let me know what you think.

Answer 1

Depends on how you do it. On the very off chance that you just display the password in plain sight (no asterisks), you can do it on the same page. But if you do it using two masked fields (type and verify), then a separate page is better, for a couple of reasons:

1. Security - you do need to make sure that it's really the account owner who is trying to change the password, rather than someone who had walked up to the computer when the owner was logged in.
2. The concept of "blank field = no change in password" is too complicated for the user to figure out by himself, and it violates basic usability principles. A blank field should mean that the field is blank, i.e. there's no password, not that there's some hidden password. A blank field in a "new user" page would pop an error message, while the same blank field in an "edit" page is ok? This decision must be made by the user explicitly, not implicitly - maybe a checkbox that says "Change password" and then enables the two fields.

If you go about this the other way, and provide password fields that are already filled in, and just show meaningless asterisks, then you're relying on the user's memory to tell him which fields have been updated. Furthermore, in this fashion it's inevitable that the user gets an error message when the user is done editing the first field.

You will need to change the page slightly. It can be a checkbox or a button that brings up a popup for the new password, or some other way.

Answer 2

Generally, I would have a separate page, for two reasons:

1. All of the issues raised above, about making sure that the users intentions are clear, and the effect of clicking change is clear.

2. The times when people are changing their personal details are liable to be different from when they are changing their password. User details are liable to change on moving house, for example, whereas a password change - maybe on a monthly basis?

I think people are generally used to having a change password page that is separate. Have a link from the profile page, but keep it separate.

Answer 3

If you want to do the one-page solution you might consider visually "disabling" the password section by default. Then the user must explicitly signal that they wish to alter their password by enabling it and filling out the fields (old password, new password, new password confirmation). If disabled, the section is ignored upon submit. If enabled, it returns all the standard errors and confirmations, etc., upon submit.