I had designed a message reading "Incorrect password" appearing on the 'Password' input field, however, a PM has given me feedback that saying: "I believe the common practice for security purposes is to generalize the error and not specify that the password is an error. That lets someone know the email is valid and can then continue on a brute force attack to gain access."

He would like me to change it to "Incorrect username or password", displayed at the top of the section.

I'm having trouble finding UX-related documentation online to back this up. Can others please weigh-in?

  • This is more a security issue. You don't want to give away information to a potential attacker if the username or the password is wrong. Read also security.stackexchange.com/questions/17816/…
    – Nash
    Commented Jun 11, 2022 at 12:37
  • Well this point was discussed here , hope this helps! Commented Jun 12, 2022 at 13:41

1 Answer 1


Well your PM has actually a valid point. Since any attacker can easily guess the username of any user and concentrate his efforts on that particular account using techniques like brute-forcing the password.

Your Question is deeply discussed here . Hope this helps

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.