I have a web-page to create a new user; Now, I want to use the same page for editing the user's profile. Is it good to use the same page for change password? OR do I have to create a separate page, which asks for the old password and so on?

I think a separate page is the old way. The new trend is to use the same screen, and if the password is blank that means "no change in password", otherwise it is updated.

Let me know what you think.

3 Answers 3


Depends on how you do it. On the very off chance that you just display the password in plain sight (no asterisks), you can do it on the same page. But if you do it using two masked fields (type and verify), then a separate page is better, for a couple of reasons:

  1. Security - you do need to make sure that it's really the account owner who is trying to change the password, rather than someone who had walked up to the computer when the owner was logged in.
  2. The concept of "blank field = no change in password" is too complicated for the user to figure out by himself, and it violates basic usability principles. A blank field should mean that the field is blank, i.e. there's no password, not that there's some hidden password. A blank field in a "new user" page would pop an error message, while the same blank field in an "edit" page is ok? This decision must be made by the user explicitly, not implicitly - maybe a checkbox that says "Change password" and then enables the two fields.

If you go about this the other way, and provide password fields that are already filled in, and just show meaningless asterisks, then you're relying on the user's memory to tell him which fields have been updated. Furthermore, in this fashion it's inevitable that the user gets an error message when the user is done editing the first field.

You will need to change the page slightly. It can be a checkbox or a button that brings up a popup for the new password, or some other way.

  • 3. When also having other changes and the password change fails, it's not obvious what happens to the other changes (and they may be lost.)
    – Inca
    Commented Sep 30, 2011 at 17:52

If you want to do the one-page solution you might consider visually "disabling" the password section by default. Then the user must explicitly signal that they wish to alter their password by enabling it and filling out the fields (old password, new password, new password confirmation). If disabled, the section is ignored upon submit. If enabled, it returns all the standard errors and confirmations, etc., upon submit.

  • I think disabling the section mitigates the user confusion mentioned by the other answers. However, it does force the user to make an extra decision that moving 'change password' into a separate page avoids.
    – jrullmann
    Commented Oct 30, 2012 at 21:47

Generally, I would have a separate page, for two reasons:

  1. All of the issues raised above, about making sure that the users intentions are clear, and the effect of clicking change is clear.

  2. The times when people are changing their personal details are liable to be different from when they are changing their password. User details are liable to change on moving house, for example, whereas a password change - maybe on a monthly basis?

I think people are generally used to having a change password page that is separate. Have a link from the profile page, but keep it separate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.