I've just finished a well-thought login validation mechanism and have asked myself the following question several times:

What does the user expect when he checks the Remember me checkbox in an enterprise application?

So, should I store only the username or the password alongside it, so the user gets logged-in right away when he starts up the application? Or should I simply save the username and have the user re-enter the password all the time?

I'm not asking whether or how to save the remembered password, that'd be a question for security.stackexchange.com and not ux.

This application (not necessarily mine) is used daily in a high frequency, so also remembering the password would be a good idea. But would it? Or wouldn't it? What does the user expect?

I've also considered implementing some kind of expiring-algorithm, but I do not fancy that so I'm now asking the experts: You!

  • Might you try surveying your users to find out what they expect? It's a good question but sounds like you might have the opportunity to get the right directly from the people who will be clicking that checkbox.
    – Sullivan
    Commented Aug 28, 2013 at 20:56
  • Please bear in mind that depending on the subject, enterprise application not only have to deal with authentication but with authorization as well. Allowing someone to be left signed in may open up a permissions can of worms... Commented Aug 30, 2013 at 12:20

2 Answers 2


This is mostly a security question, however, traditionally the "Remember Me" checkbox places a session cookie in the user's browser so as to "automatically" log the user in. Making the checkbox "remember" the user's username/password is a feature best left to the browser and could be unintuitive for users accustomed to the normal behavior.

I would go with the normal route of creating a session cookie - like you said, you can have this cookie expire to increase the security of the method. There is likely a very standard way of doing this depending on the technologies you are using to host/run your website.

Edit: Sullivan also has the good suggestion of naming this feature more properly (i.e., "Stay signed in").

  • 3
    You can also take Google's lead and change the language. Their checkbox says "Stay signed in" which is much more direct than "Remember Me" since the latter leaves an open question of what is being remembered.
    – Sullivan
    Commented Aug 28, 2013 at 21:00
  • 1
    Thank you for your answer, I might add this is not primarily based on a web application but also to desktop applications. Hence you ain't got no cookies and "stay signed in" collides a bit with that, I suppose.
    – SeToY
    Commented Aug 29, 2013 at 9:47
  • @SeToY The same practice still applies with desktop applications; typically you will store the user's credentials (or a login token) locally and automatically log the user in when they return to your application. Commented Aug 29, 2013 at 13:47
  • This is not clear. The first paragraph seems to contradicts itself. Commented Dec 20, 2013 at 9:07
  • @NicolasBarbulesco What is unclear? Commented Dec 20, 2013 at 14:48

Users like me expect to be fully remembered : name and password.

But the best approach depends on the context.

In a sensitive environment, it may be wiser to remember only the name, without password. And this would involve educating the users, otherwise the users would anyway have their computer remember the password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.