We're salting + hashing all of our passwords, but we allow the user the option to edit his/her password. However, we cannot retrieve the password to put the proper amount of asterisks into the password field on the Edit Password form. Should I plunk in a random amount of asterisks? Just drop in the entire, super long, hashed value? Show nothing at all?

I hope this question made sense, I wasn't sure exactly how to word it!

  • If the user has an account that requires authentication with a password, isn't it safe to say that the user always has a password? Standard practice is to show either a random number of asterisks or nothing. – cimmanon Sep 19 '13 at 20:05
  • 3
    I just figured a random number of asterisks could be as confusing as none at all. If I know my password is pew and I see ************* I'd be confused. Alternatively, if my password was ThisIsMyBigLongPassword and I saw **** I'd be equally confused. – DTI-Matt Sep 19 '13 at 20:08
  • Maybe just leave it empty and label the password field "new password". I think I already saw that somewere and it worked... at least for me. – Lovis Sep 19 '13 at 20:33


Your problem stems from your terms.

'Edit' can be applied on something that either the user has typed in, or that was retrieved by the system into the field. You edit the known, you cannot edit the unknown.

Security Concerns

Since most systems store passwords in a non-retrievable form, the term often associated with this process is Enter New Password rather than Edit Password. It is important to note that the latter can raise security concerns amongst users: "If they allow me to edit my password, that means someone can see it".

In system where the password is retrievable (and thus editable, like with 1Password) the convention is to put a constant and high number of asterisks, as this increase security - the constant number means people can't identify short passwords, the high number will put off potential vicious bystanders.

However, in forms that do provide, say 8 asterisks with no ability to see the password (and I've seen some of these in my life), users may be misled to think their password is made of 8 characters.

My recommendation would be to dump the "Edit Password" concept completely and replace it with "Enter New Password", the form of which will have blank field/s.


If you can't tell the user their password, at least tell them something useful about it. For example, you could tell them the last time their password was changed:

Password last changed

This allows them to spot any changes they haven't made, and also allows them to see when they should choose a new password.

  • If someone else has changed the password, how is the user to log in to see that? [Passwords should be changed regularly, and the elapsed time is useful, but not for spotting changes they haven't made!] – Andrew Leach Sep 20 '13 at 6:32
  • @AndrewLeach I was assuming the user was authenticated with a session (cookie key). Of course, if the user changes the password, there are better ways to see that it has been changed. – Brendon Sep 20 '13 at 14:30

For a website, using a placeholder on an empty password field might be a more user friendly way of going about the standard blank password = no change style of password editing:

<input type="password" placeholder="Keep my old password" />

enter image description here

If the user wishes to change their password, typing anything into the password filld will cause the the placeholder text to be replaced by the masked password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.