Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be guessed/brute forced. But they may be furious if it happens. To avoid this furiosity we are going to build very strong password requirements.

I understand that most of the users may be quiet displeased with necessity of choosing strong password so I want to provide them data why they have to do it.

I thought about tooltip like:

Our service is for sensitive data. Your password is the gate to your data. If password can be guessed or brute forced by attacker, he will have full access to your account. It happened many times with other sites in the past:
[chronology of the largest password leaks (Sony, Citigroup etc.) is here]

What is the best way to inspire users to choose strong passphrase and remember them?

Edit: I was advised to use password meter.
Say, my password requirements consist of 5 rules. I think about the following meter: When user starts typing, all 5 rules are displayed next to password field in red. As soon as user types password that falls under some rule, this rule disappears from this area. As soon as all 5 rules are satisfied, word "Strong!" is displayed instead of rules in green.

However, using password meter doesn't tell user why they should use such strong password. Should I provide such info to them? If yes, in what form? Is there a way to have users not dissatisfied because of strong minimum password requirements?

What is the chance that in case if user's password will be guessed by attacker, user will blame application developers that they didn't force him to use strong password?

  • 4
    show them passphra.se :) – törzsmókus Jan 23 '12 at 12:45
  • 2
    5 rules is too much for users to follow. Simplify it. – dnbrv Jan 23 '12 at 13:35
  • 5
    As if the average password wasn't weak enough, mobile devices have introduced one more barrier: it is way too much of a pain to type A3x&zz%1.P on the typical smartphone. – Monica Cellio Jan 23 '12 at 15:54
  • 9
    If your app is high security (e.g. banking, etc.), and brute force attacks are even a possibility, you've already failed your users. Limit the number of attempts per minute, and dictionary attacks become impossible. Look for strange patterns of user behavior. Protect your users from themselves; don't put the onus on them. – Daniel Newman Jan 23 '12 at 20:26
  • 6
    If I wrote a 30 letter password in only lower-case, would you still show me the other 4 rules as not passed? .... – Oskar Duveborn Jan 26 '12 at 23:05

10 Answers 10


It's not uncommon for sites to display password strength (weak medium strong verystrong) next to the password field.

What if you did something like this - but instead display "time to crack", an (arbitrary) estimated length of time for the password to be cracked, together with some commentary.

[password      ]  Cracked in: 1 minute 
                  You've selected one of the 10 top poor passwords used online

[password16    ]  Cracked in: 5 minutes
                  A simple numeric suffix on a common password adds little safety.

[mummyDearest  ]  Cracked in: 12 days
                  Using a pair of words from a standard dictionary has medium security.

[GonatfItbolwm ]  Cracked in: 8 years
                  No dictionary words plus mixed case, strong security

The downside is that the algorithmic complexity of doing this quickly enough might be more than the feature is worth.

  • 15
    See howsecureismypassword.net for an example of this. You overestimat the dev complexity. – Erics Jan 23 '12 at 2:04
  • 8
    "No dictionary words plus mixed case, strong security" is false security if the password is derived from something easy to discover. – Jay Bazuzi Jan 23 '12 at 6:40
  • 3
    Interesting, "howsecureismypassword.net" - does seem to back up the view that a long, but easy to remember phrase is hard to crack by a mechanical attack. – PhillipW Jan 23 '12 at 12:29
  • 7
    @JayBazuzi that's a philosophical argument; any password is false security if it's easy to discover. – Ben Brocka Jan 23 '12 at 14:54
  • 4
    @PhillipW: I don't have the URL off hand, but I came across an article a while back by a security researcher/professor that showed by mathematical proof that passwords using dictionary words and only lowercase letters and spaces was much harder to crack (and easier to remember) than the stereotypical "strong" passwords techie types usually think of. I believe this was an exercise he liked to do on the first day of class because it showed how wrong many of his supposedly security-conscious students' assumptions were. – Lèse majesté Jan 24 '12 at 20:12

There's nothing MORE ANNOYING than dictating me (a user) what password I should choose. I good example of such annoyance is this site's log-in system.

Although there are benefits of automatically preventing passwords such as "123456" and "password", here's my reasons against forcing super strong passwords:

  • Unless your system is something that a user has no choice but to log in (like a corporate network), a user will be very likely to leave it and go somewhere else.

  • A user will most certainly write down your forced password on a sticky note and plaster it to their computer screen, or email it to themselves in an open text form. How about that for safety?

  • A user will be more likely to have their web browser automatically memorize your password. This is very dangerous because in a sense a web browser will store a full form of the password in a text form (scrambled in a sense) but still very vulnerate for a trojan/worm attack.

  • Even if you make a user to set up a strong password your system will still have a weak link, i.e. user's email account that you have no control over, and I can guarantee that a user's password there is not as strong as you may force them to make.

  • Unless it's a bank, it just makes it pretty cumbersome to log in to sites that require all that password strength. Think of user experience.

  • So even if you set up the system to dictate strong user passwords the practice shows that the actual "leak" of sensitive user information may come from within your organization when one of your company's employees loses a laptop jampacked with unencrypted or unprotected data in an open form. Or your weak internal firewall will be no match for some skilled hacker attack that would leak megabytes of unprotected data before you know. This is what happened over and over in the past and this is what you should be worried about.

And lastly how I'd suggest you protect your "butt" against possible user claims:

  • Let users choose most password they like. Set up your automatic system to reject most obviously bad passwords like "123456" or "password" or all spaces.

  • Set up your automatic system to check user passwords for complexity and issue a well visible warning that a user sets up a weak password and that they are doing this at their own risk, but LET USER continue with the password of their liking.

For instance passwords such as "mycat81" should NOT be considered as weak. The reason such password is better than any of your forced passwords is this:

  • A user is likely to memorize it and NOT write it down and leave it on his/her desk.

  • A user will not be annoyed with your log-in process and label your system as "complicated" or "hard to use."

  • You'll end up paying less to your tech support people for dealing with resetting forgotten passwords or sales reps for dealing with cancellations and problems.

  • 10
    +1 for considering the whole user experience e.g. their email account – Erics Jan 23 '12 at 2:14
  • 9
    Security is only as good as the weakest link in the system - advocating for poor password practices just because there are other attack vectors is a really bad idea. – Bevan Jan 23 '12 at 3:19
  • 7
    You don't even need to make an account to post on a Stack Exchange site, and if you want to make an account, you can use a password for a service you already have set up (openID). – nhinkle Jan 23 '12 at 6:34
  • 7
    Writing down your password and leaving it on your desk may be one of the best ways to make sure you stay secure: it allows you to use different, complex passwords for each service without storing them in a location a hacker may get access to. (obviously you don't want to do this if you're at a public computer or anything, but at home it's a great solution) – Rahul Jan 23 '12 at 10:38
  • 3
    This is horrible advice all around. The 2 "problems" given (users may leave a note on their desk or may let their browser/pw manager save them) are extremely good ideas! #1: If an attacker has physical access to your machine you have lost whatever you do, even if you use truecrypt on your whole HDD and secure boot. #2: A virus/trojan that can read the browser's pw file already has to be elevated (assuming the permissions/ACLs are correctly set; you'd hope so in any case) which means it's game over anyhow. "mycat81" would probably be cracked by any modern hardware in a few hours tops. – Voo Apr 14 '14 at 16:06

An interesting article about making usable and secure passwords suggests that password based on sentences with 3 or more words such as "this is fun" are ten times more secure than cryptic combinations of numbers and letters such as "J4fS<2".

I think the root of the problem is that passwords such as "J4fS<2" are hard to remember for users, so they get annoyed when you force them to set these kind of password (and also when they fail to remember them later).

You can encourage the use of sentence-based passwords as the ones described above. In case you provide an example of this kind of password, check that the example password is not used.


Wikipedia says "People are notoriously remiss at achieving sufficient entropy to produce satisfactory passwords." (http://en.wikipedia.org/wiki/Password_strength#Human-generated_passwords)

A password meter isn't very reliable, either. They typically have rules that stop me from using very good passwords (a long, randomly-generated of lower-case letters, easy to type on my smartphone) while allowing many weaker passwords.

Meanwhile, the more complex the password, the more likely it is that a user will write the passwords down in an obvious location, such as a sticky note on the monitor.

Regardless of how strong the password is, if the user uses it in multiple systems, you expose yourself to attacks via those other systems.

One way to make sure your users are using strong, unique passwords is to generate the password for them, or at least provide them with specific instructions for doing so. While you're at it, make the password easy to remember or type.

I normally use LastPass to track and generate my web passwords. Since I never have to handle those passwords, I let it generate very long passwords. (Rude look at the sites that limit password length!)

When I need a password that I can remember, I use diceware. Alternately, you could point your users to diceware; you could generate diceware-style passwords for your user.

If security is very important, consider 2-factor authentication.

  • 4
    The strongest passwords I've used came from sites that generated them for me and suggested a pronunciation. It seems to be easier for users to remember passwords that they can think of as words instead of as sequences of special characters. – Monica Cellio Jan 23 '12 at 15:51
  • Ironically, the password "Think of as words?" would likely be even more secure and very easy to remember and type. – Oskar Duveborn Jan 26 '12 at 23:09

Discussions of passwords rapidly devolve into arguments about entropy, rules and the concommitant user experience issues. Before deciding how best to advise your users, I think there are two simple question to ponder upfront:

  1. Why do you need to get into the business of identity management? We have left the days of "one password for every site" in our dust. Unless you have a very compelling reason why it is necessary for your users to establish a new credential/identity on you site, delegate this to the dominant players (openid, twitter, facebook, google..). There is no downside in terms of development effort (arguably cheaper over time). And the password problem just evaporates; you'll likely get more sign-ups because registration friction is massively reduced too. Tools like JanRain Engage make it dead simple for developers to support multiple authentication schemes.

  2. The elephant in the room when it comes to password integrity is the simple rule "don't use the same password on multiple sites". Unfortunately, password strength meters cannot account for this. But give then choice of (a) a unique but lousy password for each site and (b) a single really strong password that I use on all sites, then (a) is best by far.

So if you really need to setup your own authentication and identity management scheme, you will do best for your users by not trying to be the wikipedia of password algorithms. Even if you just focused on the simple message of "create a unique password for this site" you will be doing a world of good. Password strength meters, advice on how to create a password etc take a distant second to this message IMHO.

btw, here's a good site for testing password haystacks (where you can prove that "Hello World" is algorithmically mega-order of magnitudes more secure than "23cd1234234")

  • This. 99% of websites shouldn't be handling passwords at all. – Brendan Long Aug 26 '14 at 15:32

Yes, you should provide the rules to your user - it's very irritating to be told that your password isn't good enough without knowing how to improve it. If you require N characters, of which 2 numbers and 3 symbols, say so and give an example.

If you have an actual need for very strong passwords, provide a link to a suitable password generator, as drumming on the keyboard does not create randomness. Also explain that if you provided the password, someone in IT could know it, which would defeat the purpose.


The problem of passwords security can be divided to the following issues:

  1. Not preventing the user from choosing secure passwords.
  2. Indicating complexity to the user and the meaning behind it.
  3. Helping the user choose secure yet rememberable password.
  4. Preventing leakage of password.
  5. Preventing hacking of password.

Points per issue:

  1. Not preventing the user from choosing secure passwords:

    • Let users choose long passwords (8-50chars) and let users choose special characters.
    • Do not accept passwords with characters that are not in the standard ASCII set of 32..126 (from ' ' until '~') as the user may not be able to renter password on another machine or keyboard.
    • The longer the password is the less complex it has to be character-type-wise.
  2. Indicating complexity to the user:

    • Provide a complexity indicator (function of length, dictionary words and types of characters (lower case, upper case, digits, symbols).
    • Let the users know what can happen if their account is hacked.
  3. Helping the user choose secure yet rememberable password:

    • Suggest methods of conceiving secure passwords that are easy to remember.
    • Enable OPENID - so the user does not have to remember multiple passwords or passwords for a one time usage of a site.
  4. Preventing leakage of password:

    • Recommend that the user does not use a password that he/she has used elsewhere.
    • Only enable secure logins (https).
    • Notify users that your employees will never ask for their password.
  5. Preventing hacking of password:

    • Do not enable more than 5 failures in a row from a given IP.
    • Do not enable more than 5 failures in a row for a given username.

Reward customers who select difficult to guess passwords or who enable methods such as Two Factor Authentication. Depending on your site/business, this might include early access to features, a free giveaway or even discounts on products. (Mailchimp are currently offering a discount for activating Two-Factor Authentication. )

Users will do something hard if there is a clear benefit to them. For most users, setting a harder to remember password has no tangible benefit to them right now, it will just cause anxiety later.


Users don't like long info (eg. evidence of password leaks).

Something like this is good enough, password plugin, cause no-one wants to see weak on their password-meter. It's simpler then your system, your system could probably improve the visual aspect.

  • For the first comment, if the website is going to be for moms and dads of 40+, they are never going to know what you mean by "cracked password". Yes, we know. But they won't, so you're information is going to be useless for x% of your customers, that ain't right :)
  • 3
    I'd like to see some actual usability studies of how effective these meters are. I suspect they are more effective than long essays on security (though education is still the best security tool from an organizational standpoint), but I'd still like to see someone do a real-world test on their effectiveness. Also, funnily enough, if you type in blink182 into that meter, it returns "good", even though this is the 5th most popular password on myspace (right after "password") as is probably on most dictionary lists. =P – Lèse majesté Jan 24 '12 at 20:28

Brute-force and security is not a user's problems. It is the problem of site admins. So why do users should solve the problems of admins?

Try to limit login from same IP to 10 times and make good restore-password mechanism. So now user could use any password now and site is secured.

User want to have password which it is simple to remember. Not everyone using password-manager software.

  • Many users under NAT can have the same IP – Andrei Botalov Dec 19 '12 at 22:16
  • @AndreyBotalov: There are about (approx.) 10% of users under NAT and about (approx.) 10% of these users could exceed 10 times login limit. If they will exceed the limit, then these users will simply restore the password. Because of this (approx.) 1% of users you are trying to force all 100% to invent long and complicated passwords. IMHO it is not useful for users. – webvitaly Dec 19 '12 at 22:43
  • If attacker has the same IP as ordinary users, he can constantly hit servers with invalid login attempts. Thus he will prevent access of all other users to your site creating login DoS for them. Users will likely to be frustrated by your site and will go to find other one. – Andrei Botalov Dec 20 '12 at 9:51
  • @AndreyBotalov: "If attacker has the same IP as ordinary users" - how could this be? :) У вас в Белоруссии IP-адресов мало? :) – webvitaly Dec 20 '12 at 12:59
  • Attacker may control botnet – Andrei Botalov Dec 20 '12 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.