In most Create Account forms that I've used, when you enter in something wrong (username not long enough, passwords don't match, invalid email, etc.), it'll keep all the fields but erase the password field(s). Is there any real reason behind this? I can understand it if the passwords are causing the invalidation, but if the email address is the problem, why clear the passwords?
The simple rule is that a password should never be stored in a retrievable format.
To be able to leave the password fields as they are, the password would have to be stored somewhere locally in a readable format - somewhere like the browser cache or a cookie. That is poor security as someone could later retrieve the password from one of these sources.
Jeff Atwood wrote an excellent blog post many years ago titled: You're Probably Storing Passwords Incorrectly. It is mostly dealing with how you store passwords on databases, but the same rules apply for any storage system (even temporary storage). The key points that he makes are:
- Do not invent your own "clever" password storage scheme.
- Never store passwords as plaintext.
- Add a long, unique random salt to each password you store.
- Use a cryptographically secure hash.
As JohnGB said, this is really a security precaution. However, there is an alternative way which is usable and secure at the same time. Rather than sending back the password
mypassword, you can:
- Send back a hidden field indicating the password is saved on the server (hashed, of course).
- In the password field, assign the value
- The user will see
********in the password field. If the user attempts to change the password, clear the field and prompt for a new password (change the hidden field indicator).
This will obviously require client-side scripting. Alternatively, you can replace the password field with
Password: ******** and add new fields for
New Password and
Confirm New Password. Then you only update the server-stored password if the user enters a new password.
Other than the password length being different, the user will only see the obfuscated form and will assume that their actual password is in the field. To this extent, their behaviour does not change.
One issue with this approach is that users cannot see their passwords so will be unable to use the show password option, if you provide it. One possibility is disabling the field with a 'Change password' button to allow the user to enter a new password.