How should feedback be given about password rules in registration forms?
a) When you focus on the password field
b) When you type the first letter of the password
c) When you stop typing, plus a small delay
d) When you tab away from the password field or click [Register], if the password does not meet the requirements.
In the case of password fields, research strongly suggests that as-you-type (with short delay) is the way to go. Luke Wroblewski has shared great experiment results answering your very question; Smashing Magazine also has a good article on this.
First I have to say is try and avoid them as people tend to reuse passwords and unique password rules make it easier to forget. Having said that, I myself had to bow down to those rules, so I understand it's not possible always.
In terms of displaying, you want the user to remain in control, so you want her to stay informed before typing in a password. This would allow the user to decide on a password and them take action on it (focus on the field, and type).So I think it should be visible all the time and not on focus or later.
You could do a highlight on the rules on focus, to help ensure that the user has not missed them, or forgotten them.
While your question ask on how to display password rules, I would instead like to argue why not to enforce any password rules at all, and why they are bad ux. I'm strongly resisting the urge to inline the obvious XKCD comic here, instead concentrating on points already made in the very related question on security.SE, Is it safe to show users why their password is not allowed?, and I'd like quote from both Tom Leek's accepted answer and mine:
[Tom Leek] In any case, "password requirements" are counter-productive and decrease security, save for a "minimum length" which can be rationally justified. So just don't do that. Key to password security is user education, possibly helped with some tools (e.g. a random generator for strong passwords).
[me] I recommend not forcing users to choose an arbitrarily complex password that they will simply end up writing down on a post-it next to their monitor (or having them reset their password as simplified "login"). Instead, let them know that their password is weak, tell them what a good yet memorable password is (e.g. use a pass- phrase instead) and allow them to proceed anyway after clicking a "Yeah, I understood my password is not very secure, let me proceed anyway" - it's their fault if the account gets hacked then and you should not be liable after this explicit warning. Assuming you did use a proper and established password hashing instead of homebrew-crap or, worse, plaintext.
So in summary, instead of displaying some arbitrary password "rules" anywhere, please simply provide a link "How to choose a good passphrase?" (phrase, not word!) and add a "password/phrase strength indicator" next to the field. Allow even something as moronic as "123" or "password" but make it clear that you don't take any responsibility for the user's not using something more secure.
And finally, take care you store the password/phrase securely and never as plaintext! See also here
I like the following pattern.
There are couple benefits. Firstly you show what the password is expected to contain "the rules" so the user has a clear expectation of how they need to pick/formulate the password.
The second benefit is that you prepare and reflect back to the user when they have achieved the "criteria". The instant feedback avoid the whole submit - error - retype cycle.
If you use a confirm password input as well this cycle can be increased as the user (nor the system) knows which password was entered incorrectly so they have to type both again - Slightly off topic this paragraph though.
The syntactical rules that govern passwords should be displayed always (or whenever it's possible to set the password), preferably right next to the password entry field(s).
Violations of the syntax should be indicated as soon as possible. Sometimes this means when the offending character is typed, but also consider the initial state violations. If a numerical digit is required, the initial state of the password field (empty state) will be in violation of this and this should be indicated. When the violation is addressed (they type in a number) this should be indicated (possible by graying out or crossing out the violation notice).
Rule of thumb: the user should know whether or not the password is acceptable as soon as possible.
I think it's fair to refer to the other answers for the question, but I would like to add the following:
If you have password rules then also present them on login as well as register.
This way any of the massive number of users who prepend a 1 or a ! to the end of their commonly used simple password will have a useful reminder.
Many users just repeatedly use a common dictionary password. If they've been pushed off this track by complex password rules then they might not remember your site has complex rules in the first place, reminding them will help them to think of what they might have entered, i.e. did they use the complex password they use repeatedly when they need to, or their common password with a special character prefix, etc.
So aside from presenting the password rules on register which is not a commonly used password related page the rules should also be displayed on the login page which will be used much more often.
Something along the lines of 'for security reasons we required you use a password with one special character' near the password field.
This suggestion is based on three pieces of provable evidence ...
... and then on the deduction that a user who chooses a dictionary password is not suddenly going to choose a random string of 15 keyboard characters just because a special char is required. Therefore there's a good chance you could jog their memory. It would be an interesting test, though I can find no such test online.
