I had designed a message reading "Incorrect password" appearing on the 'Password' input field, however, a PM has given me feedback that saying: "I believe the common practice for security purposes is to generalize the error and not specify that the password is an error. That lets someone know the email is valid and can then continue on a brute force attack to gain access."

He would like me to change it to "Incorrect username or password", displayed at the top of the section.

I'm having trouble finding UX-related documentation online to back this up. Can others please weigh-in?


1 Answer 1


Well your PM has actually a valid point. Since any attacker can easily guess the username of any user and concentrate his efforts on that particular account using techniques like brute-forcing the password.

Your Question is deeply discussed here . Hope this helps

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.