Why do users erase all the password when they hit one wrong key, instead of just the last wrong character?

Question

We login to applications almost every day. The password is stored in our fingers, as an automated process (if they have used it long enough). When users realize they have entered a wrong character (before hitting login-button) they erase the whole password, and retype the entire password – instead of just the last wrong character. Question is why?

^{download bmml source – Wireframes created with Balsamiq Mockups}

Answer 1

I would say that it is due to two reasons.

The first one you mention yourself, it's an automated process. It's easier to perform an automated process from the beginning to the end rather than breaking in somewhere in the middle and trying to complete it. In other words, it may take a user less time to write the entire password than the last third of it, because that's not a muscle pattern in the same way as the entire password is, the cognitive load for that task is increased immensely.

The other reason I would say is in the masking of the password. When the user realizes that she probably slipped on the keyboard and stops writing, she stops in the automated process. It's hard to backtrack in an automated process where it went wrong. Did she stop right after the typo, or did she write a character after the typo? Looking at the masked text will not say much.

Issues like these simply makes it easier to rewrite the entire password rather than trying to mend a broken one.

Answer 2

Because they can't see the password to know if it's only one error. Knowing there is at least one error, it makes sense that there might be more (for example, the classic "fingers strayed from the home row" scenario).

Furthermore, there's a large amount of kinetic memorization involved in typing, particularly something like passwords where there's no visual feedback. With kinetic memory, it can be easier to start from the top and follow the prescribed set of motions than it is to stop in the middle and resume. It's similar to rote memory in that way: do you know anyone who can't tell you the last four digits of their phone number without running through the first part, or who has to run down the list of letters to figure out what letter comes immediately before a given letter (example: "What letter comes before 'R'?" "Uh... LMNOPQR Q.")

Answer 3

Three reasons.:

1. A user might not actually know which character they got wrong. If they touch type, all they know is that the movement of their fingers over the keys went awry. The entry of the keys is semi-automated so they might not be aware where in the word the error was.
2. As AndroidHustle suggests, entering the password is a semi-automated finger action that is easier to do start to finish than from an arbitrary mid-point. So the re-entry requires password deletion.
3. A user may not know if they entered more or less characters than usual. It's hard to count character lengths even with 'real' text - with tiny asterisks, even more so.

Answer 4

I can't speak for others, but I know why I do it: it's because, if my fingers slip while typing, what usually happens is that I end up hitting the side of a key, or a spot between two keys, or hitting the key only weakly, rather than hitting the intended key solidly right in the middle as I meant to.

Now, depending on exactly how hard and at what angle my finger happens to hit that spot, it might result in two, one or no characters being entered. And, unless that happens right near the beginning of the password, I'm not going to start counting all the "•"s to find out which one of those cases happened — it's much easier to just erase the password and retype it.

(Possibly relevant background info: I don't touch-type, although my two-fingers-plus typing style is reasonably fast. Also, my passwords tend to be fairly long, from 12 to 30 characters — I know enough about computer security to know that, with passwords, one can have at most two out of "short", "secure" and "memorable", and I prefer to pick the last two.)

Answer 5

I think that in some cases the password is deleted as a whole because it's selected (usually shown as inverted white text on blue background).
It gets selected when the user leaves the field and returns to it, especially when doing so with the keyboard (shift + tab).
Clicking the mouse near the text should un-select it and then it can be edited.

Answer 6

There's a theory that typing is actually a two separate processes working together, where one loop puts in keys, and the other is trying to detect typos. (You ever notice how when you make a typo, you have to pause before you can correct it?)

I think this behavior makes a whole lot more sense with this theory, as it explains both the reasons in AndroidHustle's answer:

• It's an automated (opaque) process because the typo-detection process can't directly influence the typing process, just interrupt it.
• Since typos are detected by a separate process, users are used to being able to look at the screen to figure out what to do/how to fix it. Since the password is masked, they would need the skill of remembering which keystrokes they put in most recently, which is probably rarely used in practice (as you'd just look up at the screen, instead).