What are your thoughts on password meters?

enter image description here

I think they are only somewhat helpful because there is no clear indication as to how to actually strengthen the password. A novice user could maybe type in more characters in there, but it can still be considered "weak."

  1. Do you think it will work better if combined with "password criteria" on how to strengthen it?

enter image description here

  1. If we were to display the "password criteria", is the progress indicator still necessary at that point? Or is that just a way of visually communicating to the user the strength of their password to hopefully motivate them to create stronger ones?

1 Answer 1

  1. If the purpose of the meter is to help communicate the strength of the password, then the criteria should absolutely be shown. A meter by itself isn't enough to communicate "this is both long and complex enough, based on the criteria we've established for our site." Password strength meters (and strength criteria, for that matter) are unstandardized and vary widely among sites, so the user will need clear help from your system.

  2. A progress indicator is not necessary, especially if the criteria are shown. But they might help nudge the user to keep adding characters and try a little harder to make their password more secure.

One of the clearest indication patterns of a user's progress is by showing the criteria as a list, and displaying indicators in real time when each condition is met. (Case sensitivity and avoiding reuse would not be validated here, and would be listed elsewhere.)

Password strength indicators that use color and icons for each criterion

  • 2
    I second that. Every man and his dog are implementing a password strength meter nowadays, and they all do it differently. I as well as some people I know have just stopped paying attention to those meters entirely, since they are inconsistent - the same password (a 35-character password with upper- and lower-case characters and numbers but no symbols) would show as Weak on website A, as Very Strong on website B, be not accepted due to missing symbols on website C and be not accepted as too long (😣) on website D...
    – CherryDT
    Oct 14, 2021 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.