Are password strength meters useful?

Question

What are your thoughts on password meters?

I think they are only somewhat helpful because there is no clear indication as to how to actually strengthen the password. A novice user could maybe type in more characters in there, but it can still be considered "weak."

1. Do you think it will work better if combined with "password criteria" on how to strengthen it?

2. If we were to display the "password criteria", is the progress indicator still necessary at that point? Or is that just a way of visually communicating to the user the strength of their password to hopefully motivate them to create stronger ones?

Answer 1

1. If the purpose of the meter is to help communicate the strength of the password, then the criteria should absolutely be shown. A meter by itself isn't enough to communicate "this is both long and complex enough, based on the criteria we've established for our site." Password strength meters (and strength criteria, for that matter) are unstandardized and vary widely among sites, so the user will need clear help from your system.

2. A progress indicator is not necessary, especially if the criteria are shown. But they might help nudge the user to keep adding characters and try a little harder to make their password more secure.

One of the clearest indication patterns of a user's progress is by showing the criteria as a list, and displaying indicators in real time when each condition is met. (Case sensitivity and avoiding reuse would not be validated here, and would be listed elsewhere.)