What to present when wrong log in information entered [duplicate]

Question

In my sign in page I made it so that the page doesn't need to reload when the wrong password is typed (similar to Google's). What should happen when the wrong password is typed? Right now I have text beneath the password field that says "wrong password or username" in red. I personally don't like red too often because I don't want the user to feel like something bad happened. Also should I clear the password field after they typed it in wrong? The only reason I can see this being bad is if the user wasn't sure of the last character (e.g. forget there's a 1 at the end of the password).

EDIT:One thing I didn't see in other questiosn is when should the message that the username/password is incorrect go away? For example, assuming the password field is automatically cleared after a wrong password, should the "wrong password" message disapear after the first character is entered in the password field?

Answer 1

Looking at this question from another angle may be helpful. A saved failed password isn't very useful. At least if you trust the most up voted answer to my question: Why do users erase all the password when they hit one wrong key instead of just the last wrong character?

The first one you mention yourself, it's an automated process. It's easier to perform an automated process from the beginning to the end rather than breaking in somewhere in the middle and trying to complete it. In other words, it may take a user less time to write the entire password than the last third of it, because that's not a muscle pattern in the same way as the entire password is.

The other reason I would say is in the masking of the password. When the user realizes that she probably slipped on the keyboard and stops writing, she stops in the automated process. It's hard to backtrack in an automated process where it went wrong. Did she stop right after the typo, or did she write a character after the typo? Looking at the masked text will not say much.

Issues like these simply makes it easier to rewrite the entire password rather than trying to mend a broken one.

Users aren't really helped with the saved password, so I think clearing it would be great for both security and user experience reasons.

Answer 2

You should clear both password and username, or neither, your choice.
Clearing one but not the other can get a hacker/cracker ideas about where he went wrong (he may well be guessing the username as well).
For the same reason you should never state which of the two is invalid when authentication fails. Instead of "invalid password" or "unknown user" give as an error "authentication failed, invalid username/password" or something like that..