On one hand there is no need to ask for password confirmation because it is annoying. If I made a mistake when confirming my password I'll need retype my very complex password again. There is also a button that can show/hide the password so I don't need retype it in order to confirm it.

However, some users don't use the password show/hide button and the 'forgotten password' option will be pain for them.

Twitter removed the password confirmation from registration but left the dual confirmation in place for changing password. Is this right approach?

  • Does this possible duplicate question answer your query? Why should we ask the password twice during registration
    – JonW
    Commented Aug 19, 2013 at 8:03
  • I've read this question and I've understood that there is no need duplicate at registration form. And what about change password interface?
    – takayoshi
    Commented Aug 19, 2013 at 8:10
  • OK, so you're specifically asking about double-passwords on the Change Password screen? That wasn't so clear. I've amended your question accordingly.
    – JonW
    Commented Aug 19, 2013 at 8:18

3 Answers 3


It's simpler for the user to deal with 1 password field instead of 2. So that's a preferred choice.

However it is annoying to realize later if you entered the password to login and it doesn't work. In my experience, this is a smaller set of users who would face this.

So I think instead of annoying everyone with 2 password fields, use only 1. And make sure that the forgot password is a simple experience. For example:

  1. User enteres username/email + password
  2. Gets an error. If the entered username is valid, then along with the error message display a link to send the reset password link.
  3. Clicking the link should just email to the user (based on username/email field)

Password confirmation might be useful to bring out the mistake that user might make in typing his password first time. Suppose, user typed some password but it is different from what he is intending to type (this might be because of unintentionally pressing wrong key). This can be brought out if confirmation password is not matching the actual password. But it is true that, user might make same mistake in typing both the passwords and in such case, the mistake will not be known till he tries to login next time.


There are occasions where it would not be advisable to show a password in plain text. Arguably, it's probably unwise to be using a passworded application in those situations, but that's beside the point.

One potential solution I have seen used is to have both the Show/Hide checkbox and a second field. If the password is hidden, force it to be reentered; if it is shown, it doesn't need to be confirmed [and the second field might be disabled].

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.