When a user has entered incorrect details into a login form, is it better to tell them:

  • The username or password you have entered is invalid.


  • The username you have entered is invalid (for invalid usernames)
  • The password you have entered is invalid (for valid usernames but invalid passwords).

The first approach "might" be more secure, as the an attacker would not be able to confirm whether the username/email address is valid. At the same time, the user might get frustrated by not being able to remember the email address or username they signed up with.

The second approach is clearly more user friendly, but an attacker would be able to work out what a valid username/email is, and then launch an attack on guessing the password.

Some examples:

  • Amazon: There was an error with your E-Mail/Password combination. Please try again.
  • Hotmail: That Windows Live ID doesn't exist. Enter a different ID or get a new one. and That password is incorrect. Try again.

Which way should I go about displaying those errors?

  • 6
    How important is security for your site. The best approach for Paypal could be different from your personal blog comments.
    – Emil
    Nov 4, 2011 at 2:28
  • 4
    Yep, this is a security thing. Best UX is to tell them the exact problem, you'll have to decide if the "ease" of attacking is a significant great v how easy you want the site to be to access.
    – Ben Brocka
    Nov 4, 2011 at 3:02
  • I personally like the combo. Makes me fell warm and fuzzy. This means people just can't put in an email and see if it exists. This happened on facebook and people got pissed about it.
    – Matt
    Nov 4, 2011 at 7:20
  • @BenBrocka: This has nothing to do with security - it's a logic issue.
    – JohnGB
    Nov 4, 2011 at 11:13
  • 6
    @JohnGB As the hotmail example shows, this is not only a logic issue, there IS more information than just "that pair is wrong," especially in the case where that user name doesn't exist!
    – Ben Brocka
    Nov 4, 2011 at 15:39

8 Answers 8


You have to go with the first option (stating that the "username or password is invalid"), and this has nothing to do with security.

Let's say that I usually use JohnGB as my username, but on your service someone else has that username, so I use JohnGB123 instead. Say I've then forgotten my username and I enter JohnGB as my username, but use my correct password.

Is that a correct password and incorrect username or a correct username and an incorrect password?

There is no such thing as having a correct username without its matching password, and no correct password without its matching username. Usernames and passwords only represent anything when used in combination.

  • 5
    yet saying "at least one of them is wrong" gives no more information. If you put down a non existing user name - that's an error you can be told about, whereas the other way around you'll just know one of them is wrong. It's still true that if a mistake was made in both then the user cannot be told so, but in that case the other option doesn't add any info as well. Nov 4, 2011 at 11:59
  • 2
    @AssafLavie: You could say that the username exists, but you can't logically say that it was the right username. Also, if you're storing passwords in a sane way, then there is also no way of querying a particular password exists. The limitations are still logical and technical.
    – JohnGB
    Nov 4, 2011 at 12:44
  • 3
    I never suggested you could say that a password exists. You have 4 options: username/pwd can be correct/incorrect. Now if you only ever tell people "the combination is wrong" they never know which part they got wrong. That's the lowest amount of information you can share (hence people worrying about security). The other option shares more information with the user. Yes, in some cases you still don't really know what's wrong, but in other you do (e.g. non existing user name). Please see my comment to my own answer. You have to consider the "expected" UX. Nov 4, 2011 at 14:07
  • 7
    Usually when people fail to log in they're entering the wrong password to the right user account; it's true that you can't know if it's the right user name, but it's a very different thing to say "holy crap, that user name doesn't even exist what are you doing" than to say "You're using the wrong password." If the username does not exist and you just say "the combo is wrong" you're leading them down the same path of letting them try different passwords for an account they can never access.
    – Ben Brocka
    Nov 4, 2011 at 15:36
  • 3
    @Nicolas Barbulesco doesn't that imply that a user JohnGB exists? If the username doesn't exist, the user might still try multiple passwords in frustration. Jan 12, 2016 at 14:14

I'm going to give some advice from a Security standpoint + UX. I wouldn't sacrifice either one for the other. Have both.

  1. There's an important question of secure practices in your question. The Best Practice from a security standpoint is to not identify which entry was invalid, and have a generic answer. Let's ask What Would Google Do and take Google's gmail as an example: You have endenter image description here

  2. Going through the Can't access your account? link, gmail will eventually tell you that this account does not exist:

enter image description here

It's ultimately up to you whether or not you want to do this. From a security standpoint, attackers can begin to collect the valid usernames in your application. From a usability standpoint, you've just helped someone figure out which of their countless e-mail addresses they used on your account, and can get logged in sooner.

Who tells tells you if a name exists?

  • Twitter
  • Hotmail
  • Gmail

The most secure practice is to tell the user something along the lines of: "If a valid e-mail address was entered, instructions to reset you password have been sent"

This won't reveal the username. So your first option is Definitely more secure.

From a usability standpoint, you can definitely provide multiple methods of trying to get back into the account, (login with twitter, gmail, Facebook...there are API's for that).

Check out this Smashing Magazine article that reviews the many approaches to login forms:


Just to summarize: a user might be frustrated that they can't remember which email they used. A user will lose all confidence in you if their account gets hacked because ux trumped security.

I hope this helps Erics, I'm really curious what solution you end up choosing.

Some technical security stuff: To learn more about enumeration and the real danger it causes:

It may also be helpful to learn more about forgot password security from this OWASP cheat sheet: https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet

It gives best practices for business applications, but is also still useful to keep in mind. http://www.gnucitizen.org/blog/username-enumeration-vulnerabilities/

  • 4
    So I was just creating an account on a site, and I got the response: Username already exists. If you're going to do something like that, then I'd revise that you don't have to worry about revealing a username as being correct. Though it doesn't mean you have to reveal an e-mail address as being correct. cheers.
    – mustefa
    Nov 6, 2011 at 5:44
  • Great advice thanks. Can I ask you a question. I'm implementing an account lockout mechanism in my app. I'm firstly checking if a user has more than 8 unsuccessful login attempts in the previous two hours. If this is true then I will lock their account for 20minutes. If this case arises should my error message be something more specific like "Your account has been locked"? Also should I send them an email notifying them of this account lockout? I was wondering your opinion on it. Thanks
    – Sarah
    Nov 26, 2018 at 17:10
  • Following on from my comment above I've just found the Wordpress lockout error which is:"Too many failed login attempts. Please try again in 20 minutes." Sounds good to me..:)
    – Sarah
    Nov 26, 2018 at 17:25

The answer depends strongly on the system for a few reasons. A valid point is raised in saying you can't know if they have the "right" username if they don't have the right password, for example John states he might be trying to access the wrong John. But there are multiple situations where telling me the username exists can help me.

The username doesn't exist: There is no non-security reason not to let your user know this! In this case you actually know the username is wrong, not the password or the username/password combo. There's no sense in letting a user type furiously away to login to a non-existing account unless they're a bot/malicious agent. You can helpfully offer something like "Are you trying to register? Click here..." in this case as well, in case the user really doesn't have an account and they need to amke one.

My username/login is my email: Unless someone else stole my email, you can pretty fairly assume the user typed their email right and they aren't confused. Unlike the username system where names like Bob and John are taken immediately, in an email-based login system people's perferred login credentials are always availible because only they have access to them in a well designed system, as only the person with control of the email can finish creating an account for that process.

My login is an OpenID: Same reasons as above. No one else could have used my login without access to my credentials. With the advent of OpenIDs and the popularity of email-based login, many users no longer have to worry whether I signed up as John453453 here or John543553 instead.

That all said, the "wrong password" message does err on not helpful; you can't tell if that password is wrong or right for the user, just if it's wrong or right for the username entered. A system with three messages is probably most helpful:
1:Successful Login! (Password and username correct).
2:Username does not exist! Are you trying to Register? (username not "correct"/existent)
3:Password/username incorrect. (Password and username do not match. Emphasize the password being incorrect here as most people input their password wrong, not their username)

  • Getting the username right can be just as difficult as the password - if not even more. People are liable to use the same password regardless (that's another topic). But usernames often have many mutations as they can easily be taken. Using emails to login is easier to trust. I've never liked sites that doesn't accept email for login when they never the less require it anyway.
    – thomthom
    Dec 30, 2012 at 14:50

I think the security is a non issue, unless it's a penis enlargement site where being a member is something users would appreciate to be discreet. Most sites that choose option #2 still allow you to recover a password by email and then let you know if no such username exists in the database...

From a hacking standpoint it doesn't really offer much of an advantage if the system answers that a username exists. Reasonable systems won't allow too many attempts anyway, so the most a hacker can get is confirmation for a well known email/username that he's trying to hack. An if someone's a direct target their username/email is probably already known.

Many people use the same email address and/or username in all websites. So basically any admin of any of these websites already has this so called sensitive info. Nobody seems to have a problem with that, because the strength lies in the password, no the user name.

  • 2
    But what about the case where I think I am using the correct username, and the site is leading me down the path saying that my password is wrong, but the username exists? Poor UX regardless of any security questions.
    – JohnGB
    Nov 4, 2011 at 12:45
  • 2
    I would argue that this happens very rarely. People forget/mistype their passwords way more often than they do their username/email. Furthermore, you get to actually see your username in clear text. I do agree that in those cases the UX is poor, but the overall expected UX is better. Nov 4, 2011 at 14:05
  • @JohnGB More and more sites are using emails and openIDs to log in now, it's considerably less likely for someone else to have signed up for the service using my own email or Google account.
    – Ben Brocka
    Nov 4, 2011 at 15:38

If you are concerned about security issues, you should not distinguish between the wrong username and the wrong password.

That said, if you had two fields in anything other than a login page, and one of them were wrong, it would be unhelpful for the error message to read, "One of these two fields is wrong but I won't tell you which one." While the username and password must be validated as a pair, the password is much more likely to be wrong than the username because the password field is usually configured so that you cannot see what you are typing.


Use both: the first option for the first tries and after 5 consecutive failed attempts switch to the second option.

This way you keep the userfriendliness for the majority of users but it makes the work of the hacker much harder to accomplish: after 5 failures he will have to reset his cookies and change its IP or find out the correct credentials in only 5 tentatives (highly unlikely). At this stage most "attackers" would give up and if he's determined and skilled enough he will probably discard the brute-force strategy anyway.

  • 1
    Good idea. But this would be far less user-friendly than telling at once. I would give up before a sixth try ! Mar 24, 2013 at 10:59

I agree with JohnGB:

I often get frustrated with sites that tell me "Username or Password is incorrect". But JohnGB's answer above makes sense.

Just to add one of my main frustration stems from the fact that email and username are often not differentiated. For example a site my ask for my email or username but that suddenly opens up a lot more options. Sometimes they also change terminology throughout the registration process!

Be specific and be consistent. if you ask for an email as a login make sure you always refer to it as email! and vice versa.


We had a similar discussion on the best option to use on our site. Ultimately, it depends on the nature of your site and the level of security you'd wish to provide your users. We run a jobsite, and ultimately our call was to go with the Amazon approach, because we wanted the additional layer of security for our users.

Not the answer you're looking for? Browse other questions tagged or ask your own question.