12

Some sites allow you to register and only provide a single password box, which is protected with stars.

Traditionally a "confirm password" box is used when registering which allows you to confirm that the password entered is indeed the password the user wishes to use.

I know that an interface is only complete when there is nothing left to remove from it, however I got caught out this week by registering at a webservice that only asks for 1 password entry. I accidentally hit the wrong key when signing up, and ended up having to go through a password reset process in order to access the service later.

Would it not be advisable to allow password entry without the stars when going with the "single password box upon registration" model?

Improve this question
8
  • 5
    FYI, IE10 and Win8 (system only) come with an awesome feature called "reveal password", which manifests itself in a clickable eye at the end of the password field.
    – dnbrv
    Jun 26, 2012 at 14:54
  • 1
    I've slightly edited the question so the focus is more on the Masking / Not Masking the single password field to keep this question distinct from the linked one.
    – JonW ♦
    Jun 26, 2012 at 15:09
  • 1
    @JonW Yeah that's not what I got out of the original question. As you've updated it, it's not a dupe anymore for sure.
    – GotDibbs
    Jun 26, 2012 at 15:26
  • 1
    See my answer here. Default masked with an unmask option is cool (IMO), absolutely no masking ever just seems scary to many users; I even had a couple users tell me this for a test on what was obviously a mock prototype
    – Ben Brocka
    Jun 26, 2012 at 15:28
  • 1
    I collected a few good answers (including yours Ben) together to try and cover the different aspects in one place. I agree that this is no longer an exact duplicate, but it is a very near one :-)
    – Danny Varod
    Jun 26, 2012 at 15:31

5 Answers 5

Reset to default
14

I think it's a good idea to have only one password field but I think it should be masked by default, with an option to unmask. There are some users that feel this is not as safe, maybe even just because they're not used to see their password in clear text. The solution should address the concern of these users, too.

mockup

download bmml source – Wireframes created with Balsamiq Mockups

Improve this answer
2
  • What about if you used your option, but it just flashed the plaintext password for a second then returned to asterisks?
    – zuallauz
    Jan 30, 2013 at 4:22
  • 1
    @zuallauz Interesting idea. That's how it works e.g. on iOS (where the likeliness of somebody watching you while entering the password is lower). On mobiles it's vital as the touch keyboards are small and hence lead to more typos. So yes, I would use this for mobile but rather not for desktop sites.
    – greenforest
    Jan 30, 2013 at 12:19
18

The idea behind masking is that someone may be watching your screen (from behind you).

(Couldn't find an existing answer with this, even though I am sure I saw it here once, the is the closet I found is Ben Brocka's answer here.)

You could let the users elect to unmask or use the same trick used in mobile phones (temporarily unmasking the last character). (See Jonathan Dickinson's answer and Monica Cellio's answer.)

  • Both these methods are risky if you are using a normal size screen in a public location and the purpose behind the last character unmasking in mobile phones is to prevent typos created by the keyboard being to small and not having enough physical feedback.
  • Further more, both options are useless if you are not using alphanumeric characters or you are using a spatial keyboard pattern.

The reasoning behind confirmation of the password is to help prevent mistyping. As Dean wrote here displaying the password to users isn't good enough (depends on convention used for the password).

A password resetting process can be tiring and besides, the user may have mistyped his/her email address too (and that really shouldn't be confirmed: https://ux.stackexchange.com/a/21063/687).

Also, remember that password resetting can lead to security risks: https://ux.stackexchange.com/a/21744/687

Making the user type the password out twice isn't such a bad option - it can be checked via script before the user even hits the next button (e.g. as soon as the user exits the field). It gives users the chance the use their same method (for conceiving a password) over and confirms the result is the same.

If the password is too complex to type twice, you are probably forcing your user to use illogical password complexity rules e.g. entering 8+ lower case and upper case letters and numbers when the complexity of passwords is actually about the same for:

  • 15 digits
  • 8 symbols from 16 in top row only + letters + letters both upper and lower + numbers.
  • 8-9 symbols from all 32 symbols in US keyboards + letters all upper or lower.
  • 8-9 symbols from all 32 symbols in US keyboards + letters all upper or lower + numbers.
  • 8 symbols from all 32 symbols in US keyboards + letters both upper and lower + numbers.
  • 9-10 symbols from 16 in top row only + letters + letters all upper or lower.
  • 9 symbols from 16 in top row only + letters + letters all upper or lower + numbers.
  • 8-9 symbols from 16 in top row only + letters + letters both upper and lower.
  • 10 letters all upper or all lower case + numbers.
  • 8-9 letters both upper and lower case + numbers.
  • 9 letters both upper and lower case.
  • 11 letters all upper or all lower case.
  • 3 random words in modern English
Improve this answer
2
  • 5
    Note: The risk of exposing the password field in the clear isn't limited to "normal size screen in a public location". There's a myriad of scenarios: Room is monitored by video surveillance, helpdesk or conference calls use screen sharing software, malware or corporate monitoring tools use screen capture software, etc.
    – Iszi
    Jan 29, 2013 at 19:48
  • 2
    +1 Best answer. Some people are very good at watching keyboards though, so you should look out for shoulder surfers even if masked, as for the technical exploits, not much you can check for to be honest, it's impossible to be 100% thorough.
    – Lee Kowalkowski
    Jan 29, 2013 at 21:52
2

Smashing Magazine's article on Innovative Techniques To Simplify Sign-Ups and Log-Ins provides some interesting thinking around this where they have a section:

REQUIRE USERS TO TYPE THEIR PASSWORD ONLY ONCE - Smashing Magazine

Many sign-up forms ask users to type their password in two different fields. The reason is understandable. Forms mask passwords for security reasons, so that snoopers can’t see them. And to cut down on typographical mistakes and increase the chances of correct input, two separate entries are required.

In reality, though, this allows for greater error, because it forces users to type more. They can’t see the characters they’re inputting, making it difficult to know whether they’re typing the right password each time.

To add on top of that I would suggest just making sure that you have a reliable forgot password functionality for when users forget what they typed.

Improve this answer
0
2

So I think for a registration page there are three different models here:

  1. For a registration page the "mask everything but the last letter typed" seems to be an obvious model. The user can check as they are going.

  2. The unmask button (eye) is also a great solution. The point here is that users are the best judge of their current context. If they are in a situation where there really is no security risk then let them unmask if they want to.

  3. Making a user type it out twice has to be the worst of the three options. It involves a great deal more work and potential for silly errors in getting off the page simply because you are just typing more.

Companies must have data on which model produces the least password resets but this would not give the whole picture - it would need to be combined with how long the user spends on the page registering in the first place. A user test would give you that answer.

However in a sense this is a subjective question ... what do users prefer? My guess would be the one requiring least work which has to be model 1 (with the option of model 2 for checking). But I would verify it with a quick user test and subjective questionaire.

Improve this answer
7
  • If I am using a normal size keyboard and a normal size (desktop) screen in a public location, I wouldn't want the last letter to be unmasked, even temporarily. I would definitely not want the whole thing unmasked. Also, both options are useless if you are not using alphanumeric characters or you are using a spatial keyboard pattern. Making the user type the password out twice isn't so bad an option - it can be checked via script before the user even hits the next button (e.g. as soon as the user exits the field). It gives users the chance the use their same method over and confirms the result.
    – Danny Varod
    Jun 27, 2012 at 8:53
  • Exactly it's subjective we have widely different views and styles (when I have to type out my password twice I often end up having to do it five or six times before I get it right - I have a lousy dyslexic type memory for strings of stuff ... so I personally hate that model) ... However for a design decision the best you are going to get is going for the option people like most or give them the opportunity to choose their method. Thats why you have to test it for your particular user population.
    – Lisa Tweedie
    Jun 27, 2012 at 12:28
  • 1
    If you have to type your password five or six times, it is very important to make sure you have confirmed it, since that many attempts to log in will probably get your account locked. Also, try to use a different password convention e.g. a spatial combination (draw a shape on the keyboard starting at a certain point then perhaps another shape with the Shift key down).
    – Danny Varod
    Jun 27, 2012 at 12:44
  • It's only six times because they are making me type it twice (: If I could check what I was writing then I would be just fine first time.
    – Lisa Tweedie
    Jun 27, 2012 at 12:46
  • How about if you could elect to unmask both?
    – Danny Varod
    Jun 27, 2012 at 13:03
2

This is a great question and a perfect example on why you should not mask passwords when users are signing up. It's ok to mask passwords when users are logging in because if the user mistypes something they can try again. But if the user mistypes something when signing up, they have to go through the long and painful process of resetting their password. And that's only after they figure out that the reason they can't log in is because they accidentally mistyped their password!

I know most people are new to the idea of an unmasked password. But for sign ups in particular, the password really should be unmasked. There are far more people who mistype their password signing up than people who get their password stolen from unmasking. It's more of a usability issue than a security issue. Here's a great article that explains why it's better to unmask the password on sign up forms, and offers a couple of innovative approaches to temporarily unmasking: Why Password Masking Can Hurt Your Sign Up Form

Improve this answer
1
  • It would be good to add some numbers to the answer to support it, so that UX.SE users don't need to go read the whole article and the answer is self-contained even if the article disappears one day...
    – edgarator
    Nov 23, 2012 at 1:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.