Is password confirmation necessary on a Change Password dialog?

Question

On one hand there is no need to ask for password confirmation because it is annoying. If I made a mistake when confirming my password I'll need retype my very complex password again. There is also a button that can show/hide the password so I don't need retype it in order to confirm it.

However, some users don't use the password show/hide button and the 'forgotten password' option will be pain for them.

Twitter removed the password confirmation from registration but left the dual confirmation in place for changing password. Is this right approach?

Answer 1

It's simpler for the user to deal with 1 password field instead of 2. So that's a preferred choice.

However it is annoying to realize later if you entered the password to login and it doesn't work. In my experience, this is a smaller set of users who would face this.

So I think instead of annoying everyone with 2 password fields, use only 1. And make sure that the forgot password is a simple experience. For example:

1. User enteres username/email + password
2. Gets an error. If the entered username is valid, then along with the error message display a link to send the reset password link.
3. Clicking the link should just email to the user (based on username/email field)

Answer 2

Password confirmation might be useful to bring out the mistake that user might make in typing his password first time. Suppose, user typed some password but it is different from what he is intending to type (this might be because of unintentionally pressing wrong key). This can be brought out if confirmation password is not matching the actual password. But it is true that, user might make same mistake in typing both the passwords and in such case, the mistake will not be known till he tries to login next time.

Answer 3

There are occasions where it would not be advisable to show a password in plain text. Arguably, it's probably unwise to be using a passworded application in those situations, but that's beside the point.

One potential solution I have seen used is to have both the Show/Hide checkbox and a second field. If the password is hidden, force it to be reentered; if it is shown, it doesn't need to be confirmed [and the second field might be disabled].