I find this way of doing it highly annoying when I come back to a site I haven't used in a while. First having to enter my email to get my username and then enter my username and email to reset my password.

Why do sites split it up like this? Is it believed to be better UX? Better security?

I mean, the weak point is my email in both cases, so if someone got a hold of that they would get both the username and the password anyways. So why not just combine it into one function where you only need to supply your email?

6 Answers 6


Well, this is some kind of old approach imo. A while ago username was usually used for two purposes: as identity (to log-on) and as something to display (when you post comments for instance). I believe it came from standalone apps and operation systems, where email is something secondary and username is something primary. Meanwhile it doesn't work in a web, where user email is usually a primary thing.

Modern sites have better UX by separating a way you log-on and a way you communicate with other users:

  • When communicating with other users, they only see your name, doesn't know how you actually log-in (email, smart card etc..).
  • When it come to your identity, email (or similar unique id) is used. So when you like to recover ability to log-in, you just enter your email address and password recovery process starts. Name is not involved.

So, finally answering your question, this wrong log-in approach causes also a wrong recovery process.

  • That makes a lot of sense. I fully agree :)
    – Svish
    May 30, 2012 at 13:44

I think the reason is that, when people forget their password, they have several pieces of information that they can use to retrieve it.

  1. Their username.
  2. Their email
  3. Their security question.
  4. etc.

However, when they forget their username, the sites can't use their username to find their username, because they don't know it. So the site has to use different pieces of information to find what their looking for.

Yes, in all of the cases the person still has their email, which can be used to identify their account, but it's still a good idea to get as much information about the account as possible, so no mistakes are made. By splitting up the process, the site is collecting as much information about the account as possible, so that they can be 100% sure.

In addition, most of the time people remember their password, but not their username, or vice versa. Separating the process makes it easier for them.

  • Hm, for me it's more like neither or both. Either I know both my username and my password because I've been using the site regularly, or I remember neither because it's been a while. And besides, the email should be a unique key anyways, so why ask for another detail? I just find that annoying. And also, the security question I gotta say is horrible... I usually put in an enormous hash of some sort as the answer and store it in KeePass :p (I do that for username and password, but I don't have all sites in there yet. Came over this issue with last.fm which I hadn't used in ages :)
    – Svish
    May 26, 2012 at 18:13

We contemplated using a one stop shop for resetting passwords and reminding users of their Client ID and Username (we're a mutli-tentant web-app, so we need both) but we decided against it for a couple of reasons:

  1. Security: Having one field allows someone to not know your username and it also allows them to change the password of the account in one step.

  2. Simplicity: due to the nature of our back-end services, we have multiple services that are used by our login system that made it easier to have multiple fields, like forgot username and forgot password.

  3. User Guidance: By having a login help form that says: "To reset your password, enter in either your Email Address OR Client ID and Username" as well as a separate (although very close proximity) form saying "If you forgot your client id/username enter in your email address" has helped our clients better serve themselves.

  • 1
    Must say I disagree with point #1. Adding a second step doesn't increase security when the email is still the only key you need. For #2 I believe we shouldn't design our UX based on our backend services. Solutions should be easy to use for end-users, not developers ;) As for #3, it's a bit of a difference case you describe. "Email" OR "Client ID AND Username" ask for two separate kinds credential. In my case I was asked for "Email" to get username and then "Email AND Username" to reset password. Or did you mean that the password was only reset when you provided "Client ID and Username"?
    – Svish
    May 30, 2012 at 13:53

I think it purely helps with the case if people can remember their password but have forgotten their username. Then a site can simply send out the username to the email address. This is safer, since it doesn't involve sending out the password in plain text. Or its less annoying because it involves needlessly resetting the users password - which means they have to go through the password reset process when they can remember their password.

If the user's forgotten their password then they should be able to click a link that says 'forgotten password' and an email with username and a new randomly generated password (or one-time token) should be sent to the user's email address.

Further to that as per this question the site could also accept both a username and email in the username input to avoid people forgetting their username. Then you only ever need the 'forgotten password' link.

  • Sorry to bump such an old post, but it should be impossible for you to tell someone what their password is. You should have no way of knowing or retrieving or sending their password to them because you should have it stored in a one-way encoded field ("salted and hashed") that cannot be reversed to find the original password. If you can send their existing password to them then your site is insecure and worse, acts as a security hole for other sites the user may use. One should only be able to reset their password, not retrieve it.
    – Stephen P
    Jun 2, 2014 at 22:46
  • @StephenP I quite agree, what I meant with this is is a temporary 'reset' password is emailed out, not their current one. I'll edit it to make it clear.
    – icc97
    Jun 3, 2014 at 9:49

This is for your safety.

Your identity (username) needs to be separated from your password because those 2 things are handled by different systems:

Google is moving towards strengthening the second part (passwords) with new technology, which doesn't work if it's all on one page.

The core problem is theft: with both in one place, it's too easy to steal them (eg. phishing, scammers, spoof sites, mitm, etc). The separation makes it possible to block the theft completely (via the new technology).


There is another reason why "progressive disclosure" on login makes sense. From time to time users should be forced to complete some tasks before they get logged in and see the main screen of the application, as

  • change passwords (e.g. when accounts were hacked and users have to change passwords)
  • complete profile setting
  • answer security questions
  • answer captchas from time to time

In such cases "progressive disclosure" helps to add one or more such extra steps during the login process by adding an extra screen for each of this steps.

Since this is part of an extended login process, login may be prevented if such an extra is not executed successful.

if there is no progressive disclosure available such extra steps wohld have to be implemented in a second step after successful login. And this requires extra forms and extra screens, too.

So, progressive disclosure is a good approach for an extendable and modular login process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.