2

I am using a browser-based password manager. For most websites the login workflow is:

  1. Go to login page. Both username and password field are visible.
  2. Credentials are auto-filled by password manager. If there are multiple credentials associated with this site, the first set is picked.
  3. (Optional) Select alternate credential set from a dropdown.

However, some websites (for example Google Accounts) have a two-step login. First you fill in your username and hit next, a new page loads, then you fill in your password and hit next, now you are logged in. (Note: So I don't mean two-factor authentication.)

With a password manager this becomes:

  1. Go to login page. Only username field is visible.
  2. Username credential is auto-filled by password manager. If there are multiple credentials associated with this site, the username from the first set is picked.
  3. (Optional) Select alternate credential set from a dropdown. Username from that set is filled in.
  4. Click Next. Password field is now visible.
  5. Password credential is auto-filled by password manager. If there are multiple credentials associated with this site, the password from the first set is picked.
  6. (Optional) Select alternate credential set from a dropdown. Password from that set is filled in.

So, if I have multiple credentials associated with a website, it is more difficult to log in with a password manager. If I don't want to use my default credentials, I must remember step 3 and 6, otherwise a bad username-password pair are picked.

Password managers are generally considered a best practice these days, including for everyday users. So I assume the UX designers must be deliberately breaking the workflow for "a user with multiple credentials stored in a password manager". Why? What benefit is gained from a two-step process that makes it preferable to a single-step process?

2

The current state is far from ideal, but it is the best solution for the 👇problem. The fact that some password managers are having a hard time working with it is another problem :)


This usually happens when the service starts offering other means of logging in, not only the email/password combination. For example services like Okta, or other corporate solutions. And these don't always need a password to log in. So the flow is as follow:

  1. Let us know who you are
  2. (A) You are a regular customer, so we will present you with a password input
  3. (B) You are a corporate customer, so we will present you with respective service

If you would keep it on one page it would get complicated rather quickly, especially if you would support more then one service. And even if you would support only one, you would end up with two email fields: one with a password and the other one with the corporate solution. It would lead to even more confusion.

  • You should write an article about this @rojcyk. After researching this subject your answer is the best sum up I've seen to explain it. The old method was email/pass to authenticate. But modern platforms likely need many steps and require many logical flows for authentication. email/pass are only two of these required steps. – Ben Racicot Oct 19 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.