How should feedback be given about password rules in registration forms?

a) When you focus on the password field

b) When you type the first letter of the password

c) When you stop typing, plus a small delay

d) When you tab away from the password field or click [Register], if the password does not meet the requirements.

  • 7
    e) don't have password rules and let the user enter whatever they like... ?
    – JonW
    Commented Aug 20, 2013 at 16:30
  • Are we there now? If the user wants "123" as his password, we let him?
    – forthrin
    Commented Aug 20, 2013 at 18:22
  • Well we could be, but that's not exactly what I'm saying. I'm just suggesting that your a-d aren't your only options. From a pure UX point of view then shouldn't allowing your users to use whatever they want as a password something worth considering?
    – JonW
    Commented Aug 20, 2013 at 19:06
  • 1
    @forthrin Yes, if the user wants "123", let them. It's their account they leave basically open for everyone, not yours. It's just like your landlord cannot really force you to actually lock your door, though you usually do Commented Aug 21, 2013 at 8:13
  • 4
    I would let them use "123" but give them feedback as to why it's bad/good, eg "This password looks easy to guess" or "Great password very strong" Commented Aug 21, 2013 at 10:31

6 Answers 6


When to display invalid password input?

In the case of password fields, research strongly suggests that as-you-type (with short delay) is the way to go. Luke Wroblewski has shared great experiment results answering your very question; Smashing Magazine also has a good article on this.

                  A form showing inline validation

Where to display the password rules?

  • Always - increases cognitive load. The password rules are only relevant to the user when they type their password. (You can derive at this by means of design over-dissection - if the form would turn a wizard, where would you put the rules?).
  • On Focus - Optimal option.
  • On Blur - This may be a tempting option since users may enter a valid password, so why bother them with rules? But if there is an expected behaviour from users you should inform them beforehand rather than telling them off afterwards. The cash point example below exemplifies this:

                               A wireframes of two different cash points.


First I have to say is try and avoid them as people tend to reuse passwords and unique password rules make it easier to forget. Having said that, I myself had to bow down to those rules, so I understand it's not possible always.

In terms of displaying, you want the user to remain in control, so you want her to stay informed before typing in a password. This would allow the user to decide on a password and them take action on it (focus on the field, and type).So I think it should be visible all the time and not on focus or later.

You could do a highlight on the rules on focus, to help ensure that the user has not missed them, or forgotten them.

  • Users are so educated on passwords these days that there's no point in enforcing rules?
    – forthrin
    Commented Aug 20, 2013 at 18:23
  • 1
    I agree, if there are rules, be open about them. Visual clutter etc. are a different problem that can be solved in many ways. Hiding the fact that there are rules is not the way to go about it. Commented Aug 21, 2013 at 9:14

While your question ask on how to display password rules, I would instead like to argue why not to enforce any password rules at all, and why they are bad ux. I'm strongly resisting the urge to inline the obvious XKCD comic here, instead concentrating on points already made in the very related question on security.SE, Is it safe to show users why their password is not allowed?, and I'd like quote from both Tom Leek's accepted answer and mine:

[Tom Leek] In any case, "password requirements" are counter-productive and decrease security, save for a "minimum length" which can be rationally justified. So just don't do that. Key to password security is user education, possibly helped with some tools (e.g. a random generator for strong passwords).

[me] I recommend not forcing users to choose an arbitrarily complex password that they will simply end up writing down on a post-it next to their monitor (or having them reset their password as simplified "login"). Instead, let them know that their password is weak, tell them what a good yet memorable password is (e.g. use a pass- phrase instead) and allow them to proceed anyway after clicking a "Yeah, I understood my password is not very secure, let me proceed anyway" - it's their fault if the account gets hacked then and you should not be liable after this explicit warning. Assuming you did use a proper and established password hashing instead of homebrew-crap or, worse, plaintext.

So in summary, instead of displaying some arbitrary password "rules" anywhere, please simply provide a link "How to choose a good passphrase?" (phrase, not word!) and add a "password/phrase strength indicator" next to the field. Allow even something as moronic as "123" or "password" but make it clear that you don't take any responsibility for the user's not using something more secure.

And finally, take care you store the password/phrase securely and never as plaintext! See also here

  • Excellent points! Inform, but not enforce. Now, where is everyone's favorite JavaScript passphrase strength calculator that I can borrow?
    – forthrin
    Commented Aug 21, 2013 at 11:17
  • Glad to hear you agree :) StackOverflow to the help: stackoverflow.com/q/948172/321973, and webtecker.com/2008/03/26/…. Here's a nice read (on a quick glance at least): tech.dropbox.com/2012/04/… linking to github.com/lowe/zxcvbn - that latter one looks quite informative: dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html Commented Aug 21, 2013 at 11:19
  • (though the latter is a bit too verbose for my taste - I would instinctively distrust a website that shows my password in cleartext) Commented Aug 21, 2013 at 11:28
  • While zxcvbn seems brilliant: 680K for this? Is there a small one that does not use a framework and still does a great job?
    – forthrin
    Commented Aug 21, 2013 at 11:32
  • That certainly depends on the complexity you want - a small checker will simply not be as sophisticated, but then again it's probably not your responsibility to give a precise estimate, so a simple entropy-meter might suffice Commented Aug 21, 2013 at 11:51

I like the following pattern.

There are couple benefits. Firstly you show what the password is expected to contain "the rules" so the user has a clear expectation of how they need to pick/formulate the password.

The second benefit is that you prepare and reflect back to the user when they have achieved the "criteria". The instant feedback avoid the whole submit - error - retype cycle.

Inline password validation

If you use a confirm password input as well this cycle can be increased as the user (nor the system) knows which password was entered incorrectly so they have to type both again - Slightly off topic this paragraph though.


The syntactical rules that govern passwords should be displayed always (or whenever it's possible to set the password), preferably right next to the password entry field(s).

Violations of the syntax should be indicated as soon as possible. Sometimes this means when the offending character is typed, but also consider the initial state violations. If a numerical digit is required, the initial state of the password field (empty state) will be in violation of this and this should be indicated. When the violation is addressed (they type in a number) this should be indicated (possible by graying out or crossing out the violation notice).

Rule of thumb: the user should know whether or not the password is acceptable as soon as possible.


I think it's fair to refer to the other answers for the question, but I would like to add the following:

If you have password rules then also present them on login as well as register.

This way any of the massive number of users who prepend a 1 or a ! to the end of their commonly used simple password will have a useful reminder.

Many users just repeatedly use a common dictionary password. If they've been pushed off this track by complex password rules then they might not remember your site has complex rules in the first place, reminding them will help them to think of what they might have entered, i.e. did they use the complex password they use repeatedly when they need to, or their common password with a special character prefix, etc.

So aside from presenting the password rules on register which is not a commonly used password related page the rules should also be displayed on the login page which will be used much more often.

Something along the lines of 'for security reasons we required you use a password with one special character' near the password field.

This suggestion is based on three pieces of provable evidence ...

  1. that users choose poor passwords en masse.
  2. that users re-use the same password for many things
  3. that users often have poor memories for things like passwords, especially when a long time lapses between usages and with visual memory removed through password obfuscation.

... and then on the deduction that a user who chooses a dictionary password is not suddenly going to choose a random string of 15 keyboard characters just because a special char is required. Therefore there's a good chance you could jog their memory. It would be an interesting test, though I can find no such test online.

  • Not really "rules" if it's only a recommendation shown when you log in.
    – Mike
    Commented Feb 7, 2014 at 13:04
  • the question is clearly about presenting password rules, not about what the rules are or should be, so I recommend they are presented on login for better usability
    – Toni Leigh
    Commented Feb 7, 2014 at 13:18
  • And, even though I say so myself, it's a very good suggestion, relevant to the question !
    – Toni Leigh
    Commented Feb 7, 2014 at 13:52
  • Can you elaborate on why it should be displayed on log in? Do you mean before you log in, or on the form? The user should already know their password when visiting a site, no?
    – Mike
    Commented Feb 7, 2014 at 14:19
  • 1
    If I go to log into a website and I don't know my password, a tool-tip telling me "your password must be 8 characters, and contain 2 special characters" won't make me remember what I chose.
    – Mike
    Commented Feb 7, 2014 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.