If a login fails; should the site explicitly tell the user if it was the username or the password that was wrong? or should it just tell that the combination of username/password was wrong (ie. no clue if such a username even exists on the site)? What is considered best practice for this?

Of course on Unix-systems no clue is given, and the user is just informed that the username/password is incorrect. This is obviously more secure; as it prevent crackers from even knowing if such a user even exists on the system, or if it was just the wrong password. On the other hand, for legit user this hardly poses any problems, as you probably don't have that many accounts on different Unix-machines, nor is likely to try logging-in on random Unix-computers - you ought to remember the correct user-name for your few accounts.

On the web though, there are lots and lots of sites, and it's easy to loose track of which services you've signed-up for (for me at least) — not to mention what username you used. I at least find it annoying if after several failed attempts at remembering my correct password, I discover that I don't actually have an account on the site — at least not with the username I tried.

So any thoughts? Should the user be told if it is the username or password that is wrong? or should he just be told that the combination is wrong (which could mean no such account exists at all)?


For the user experience, it's way better to be told that there is no account associated to this email/username. Because, when you have many email address it's way easier to find what was the email used for the account when the site tells you that you are using a wrong email.

However, there is one thing I would consider before making a choice. What is the importance of the information that can be found the account? If it's critical information, do not provide any feedback other than "the combination is wrong". If there is not a lot of personal information on the site, you can go for "the email is wrong" and "the password doesn't match" (or anything along that).


From an UX standpoint website should never ask for usernames for logging in in the first place. Why should a user have to put in the effort to think up a unique username, or go through the trouble of "this username was already taken". Everybody already has an email address, it's already unique, almost everyone can always remember their address, and you're going to ask me about my email address anyway. The added security of a username is negligible in most cases.

So, if your website for some reason requires users to log in with a username, make it easy for your users to figure out what exactly went wrong when logging in. The real security is in the password, so it would be fine to say "we don't have a user for " and "password incorrect".

I bet some security experts will disagree with this... sensitive topic ;)

  • 1
    what if I have more than one email address? – Hugo Dozois Apr 18 '13 at 13:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.