I put together a password strength meter for a signup form, and overall it works very well. It hooks into our DB for the "rules" (number of characters required, mix of letters and numbers, etc.), and uses that info to display a live meter that tells the user how strong their password is. The meter uses a 5-step color-coded scale: "weak" (red), "low" (orange), "medium" (lighter orange), "strong" (yellow), "very strong" (green).

What I'm curious about is this: no matter what you type, the meter immediately starts out displaying "weak" (red) because you haven't yet typed the minimum number of characters. Is it possible this would have a negative effect on conversion? It's almost like being guilty until proven innocent - you're told right away that your password is unsatisfactory before you even have a chance to finish typing it.

  • 1
    I'd check whether this still works for users with Red/Green colour blindness... – PhillipW Nov 20 '11 at 22:54

Not a usability study - but a suggestion anyway:

You could indicate to your users that at least 'n' characters are required (although I'm against the idea of chucking loads of prerequisites at users generally), and then not actually calculate/show the password strength unless the user has entered at least that many characters.

If 'n' is not large, (12 would be too large, but 6 should be ok as a minimum length) and most passwords will typically reach or exceed 'n' then it should work out ok - but as always - test with real users.

That way, people might add a few more different digits or characters to take the password up to a length of 8 or 10 say, in an attempt to reach a higher strength, which is typically what happens in this scenario anyway.


Here's a good example from Lulu.com, where the initial message for password strength is not about the strength of the password, but a grayed out, but visible indication that it is currently too short - once you get past the 'too short' prerequisite (6 characters in this case) - then you can then indicate the strength. The minimum required length is displayed.

enter image description here

enter image description here

enter image description here

  • having said that - perhaps this method doesn't promote strong passwords because it will have a tendency to produce a less robust first 'n' characters, than might occur if the user sees earlier that their password is weak. Depends on your desired balance of true strength-of-password vs conversion. – Roger Attrill Nov 10 '11 at 16:32
  • Added an example where first indication is not about the strength but about length. – Roger Attrill Nov 20 '11 at 13:25
  • I like this. Very similar to how ours works, but it stays in a default state until you've passed the minimum number of characters so that it doesn't immediately give the impression that there's an error or you've done something wrong. Nice. – daGUY Nov 21 '11 at 16:43

These are not usability studies, per se, but discuss the way that people actually use passwords and their implications on the cognitive load of users. They are all co-authored by Cormac Herley, who is a Principal Researcher at Microsoft Research.

Do Strong Web Passwords Accomplish Anything?

We find that relatively weak passwords, about 20 bits or so, are sufficient to make brute-force attacks on a single account unrealistic so long as a "three strikes" type rule is in place.

A Large-Scale Study of Web Password Habits

The study involved half a million users over a three month period.

  • 1
    Great answer! I wish we could direct other new users to it to show how links should be posted. – dnbrv Feb 27 '12 at 23:43

You're judging the user's password a bit too soon. In addition, a password that doesn't meet your minimum password requirements isn't "weak", it's invalid, the message should indicate this. If I'm okay with a weak password and the form tells me the password is "weak" but not "invalid" I might just click okay and try and continue.

Don't call an invalid password "weak", display something to the effect of "7 more characters" or "8 characters required" until they meet the minimum strength, then you can start displaying the password strength messages.

As far as "Guilty until proven innocent" it's best to keep judging the password they type as they're typing it, despite this situation. Imagine how annoying it would be if the password were only checked after I clicked out of the password field; I wouldn't know if my password was good or not until it's too late! Frustration!

  • "As far as 'Guilty until proven innocent' it's best to keep judging the password they type as they're typing it, despite this situation." That's the part that I'm most concerned with - is it better for conversion to have a password strength meter even with that issue, or no meter at all? – daGUY Nov 10 '11 at 19:15
  • I don't have hard numbers, so a quick usability test even with a couple people from the office/ect could be a good way to go; you won't see conversion rates but if there's a clear problem as they use it you may see it. Honestly for raw conversion numbers I assume no meter whatsoever would have a slight advantage in keeping the form less complex, I answered assuming you did want to keep the password meter though. – Ben Brocka Nov 10 '11 at 19:35
  • 2
    An important point: don't just tell me my password is weak and leave me guessing how to fix it; give me some advice! – Jimmy Breck-McKye Nov 10 '11 at 20:21
  • @JimmyBreck-McKye I was wondering if this system was doing that too (screenshot? Prototype?). My favorites are always the ones with checkboxes that show you like: [X] Length [] Capitals and lower case [X]Letters and Numbers – Ben Brocka Nov 10 '11 at 20:24

Passwords generally have rules. User's need to know which rules have not yet been fulfillled, and not whether the password is strong/weak. So, why not show them 4 out of 6 password rules are fulfilled, and show the one;s that are not yet fulfilled.

  • 2
    Unfortunately, that's not what the OP was asking. He was looking for studies on password strength meters not password rules. Moreover, constraining users with password rules is a bad practice because white horse in sneakers eats pink grass is a solid password without special characters or numbers. – dnbrv Feb 27 '12 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.