99

Possible Duplicate:
Why should we ask the password twice during registration?

When designing a new and simplified signup page I got into an argument with a colleague about the necessity of the "repeat password" field.

We designed the signup process in such a way that the user will be logged in automatically after completing the email verification process. So, at least initially there will be no need for the user to enter their password. Therefore the user will only 'verify' the password when logging in the second time in case we omit the "repeat password" field.

We do have a "recover password" option so in the worst case the user could go through that process in case they mis-typed the password when signing up. But then again, how often do you mis-type your password?

Even the big players don't seem to agree on which way is the best...

Don't need to re-type the password:

  • Twitter
  • Facebook (although they require re-typing your email)
  • Dropbox

Need to re-type the password:

  • Yahoo
  • Reddit

Is this necessary?

Improve this question
11
  • 2
    DropBox doesn't have a repeat box, and the signup feels really confortable.
    – Ignacio
    Aug 17, 2010 at 19:10
  • 1
    Passwords are evil! Seriously, this repeat password rubbish is slowly dying out in the sites that have better signup and signin interaction designs. Try creating a new account on librarything.com for instance.
    – Stephen
    Aug 18, 2010 at 0:23
  • 5
    openid is nice for home users, but if your site is aimed at larger corporates then a lot will have openid providers like yahoo blocked, possibly even myopenid.
    – Chris S
    Aug 22, 2010 at 22:04
  • 5
    Twitter did great by me- their "don't need to retype your password" also includes a "don't tell you that you can't include spaces in your password" feature that caused me to create a password when I signed up that could not be accepted by their password page but they didn't tell me that at the time. Only after going through arduous password recovery did I find a page that finally told me my previous password was unacceptable...
    – glenatron
    Oct 13, 2010 at 21:57
  • 5
    Typing a password incorrectly is incredibly rare, IF you're reusing the same password across multiple sites, because you've already typed it a thousand times or more. Users who follow better practice, by having a unique password for each site, are much more likely to mistype as they don't have the muscle memory trained.
    – Bevan
    Feb 28, 2011 at 19:05

14 Answers 14

Reset to default
78

I'm no UI expert but I think in many cases it is unnecessary. Certainly in my own experience it is rare for me to enter a password incorrectly. A better solution is to not have a password at all. Use one of the growing number of authentication providers (e.g., OpenId, Google, Facebook, Twitter, etc). Why does the user need another password for your app or site?

The technical users of your app will use a password generator and/or storage mechanism. The non-technical users will use one of the favourite throwaway passwords that they use for many different sites/apps. Better to just integrate with an authentication system they already use. There may also be other knock on benefits for your application such as integration into Google Apps if you use Google's auth.

If you do choose to require the user to provide a new password to your application then at least don't clear the password field on form entry error. Nothing is more infuriating than having a password field get cleared because you make an error in some other part of the form. You fix the error resubmit and then there is an error again because the password is missing. This drives me nuts. If you are concerned about echoing the user's password back in the HTML, don't. There are many other options. Encrypt it in the form, remember it in session state, use a dumby password in the HTML. Whatever, just don't force the user to enter it again!

Improve this answer
8
  • 16
    +1 using OpenID or similar and for not clearing the password on error.
    – pipTheGeek
    Aug 17, 2010 at 14:58
  • 2
    +1 I like the idea of deferring authentication to a trusted third party.
    – Chuck Conway
    Aug 17, 2010 at 16:05
  • See: ui.stackexchange.com/questions/78/…
    – Robert Fraser
    Aug 18, 2010 at 2:56
  • Just OpenID!! Do something like stackoverflow. provide buttons for simple login using OpenIDs.
    – Morteza Milani
    Aug 18, 2010 at 18:35
  • 1
    I would also add third party apps as authentication providers. But please consider: Nobody (statistically speaking) has an OpenID and knows of it. Our webservice has several hundreds of thousands of users and less than 5% of all logins are openID logins.
    – Oliver
    Jan 6, 2013 at 13:15
28

Microsoft has a pretty nifty way to solve this: the unmask password checkbox (connect to WiFi in Windows 7, and Vista I think). I really think that's the best of both worlds.

I personally don't have people looking over my shoulder 24/7; and neither do most users. Furthermore you can type the password in and simply unmask/mask to briefly check it.

Improve this answer
1
  • 2
    A List Apart has a nice article about this, see The Problem with Passwords. Suggesting to have a checkbox to hide the text or to show the last types key as a normal letter.
    – Lode
    Oct 5, 2010 at 7:46
26

It's not a requirement, especially if you have a way to reset it. I would bet that a lot of people use cut and paste on that anyway. I tend to be of the mindset that signing up for anything should be as easy as possible. JMHO.

Improve this answer
11
  • 9
    @Chris I thought it was to make sure you didn't make a typo.
    – Jouke van der Maas
    Aug 17, 2010 at 14:29
  • 4
    @ChrisF I was always under the impression it was just to prevent typos. Never thought about the memory assistance part.
    – NickAldwin
    Aug 17, 2010 at 14:30
  • 1
    Point taken on the typo prevention.
    – ChrisF
    Aug 17, 2010 at 14:39
  • 1
    I've been saved a couple times on the typos. I'm sure the reason it's there is the first internet company that required a password did not have two fields, but only had one field. 80 percent of their support calls where how to change a password. So they added a second field and created an automated way to retrieve and change the password.
    – Chuck Conway
    Aug 17, 2010 at 16:04
  • 3
    You cannot cut to the clipboard from a password field in the browsers I've used.
    – mskfisher
    Aug 17, 2010 at 17:11
23

The question boils down to "what's the cost of a mistyped password". With some systems that cost is high, and that's why they ask you to retype. For example if you are setting up an account on a (non-free) ISP then being unable to access your account probably involves going through a whole load of identify verification steps with tech support.

With a lot of free online systems the cost of a password mistype is low. If you mistyped your Twitter password the worst that can happen is that you have to create an account a second time. Likewise if you mistype it in Facebook, and they've got your email, you can request a password reset, which is why they ask for your email twice and not your password.

As most systems become the second type, rather than the first, password repeats are going to get rarer.

Improve this answer
1
  • 4
    I agree with the argument ‘cost of a mistake’. It's better to prevent mistakes from happening than to offer ways to fix them. In an encryption desktop app, the cost of a typo would be very high (bye bye data), so having to enter it twice is a small fee to pay.
    – Peter Frings
    Mar 1, 2011 at 17:47
10

Yes, sometimes. Why? Because sometimes you don't verify a user's details when they sign up, meaning that if they forget their password, it's more difficult to allow them access again.

Reddit and Yahoo don't verify email addresses (at all), so it's more important that the user doesn't forget their password. This is why they have two password boxes.

Twitter and Facebook don't give users full access if they haven't verified their email address. Since they want their users to be verified, ideally, it's more important to get their contact details correct than their password.

I hope that answers your question!

Improve this answer
9

have you ever create a password protected archive file.

alt text

alt text

while creating a password protected archive file using winrar, there is one option "show password". If you check that option, you no need to retype password. Because when password is not visible its a high probability that user can make a mistake. and he will end up with a wrong password.

most of the users are not software engineers.

Improve this answer
4

I've been moving away from masked password fields. If the user sees what they're writing, they're better able to remember it (visual enforcement), they can see if there's typos, there's no need to re-type it, and my personal opinion is that it's less stressful on the user.

Improve this answer
14
  • 5
    But wouldn't this prevent user from signing up if their computers are not secluded?
    – Sruly
    Aug 17, 2010 at 15:28
  • 1
    If a user signed up for your site from any of the computers at my place of employment, we would have their password because all of the plain text gets recorded.
    – LoganGoesPlaces
    Aug 17, 2010 at 15:47
  • @LoganGoesPlaces the same would happen regardless. The only way to prevent it is by using ssl.
    – Chuck Conway
    Aug 17, 2010 at 16:07
  • 2
    @LoganGoesPlaces - how do you record it? By reading the values from the form? By capturing keystrokes? Both of those will read values in password fields as well.
    – Charles Boyung
    Aug 17, 2010 at 18:32
  • 6
    I personally prefer having the password masked and provide a checkbox that allows the user to see the password. Of course this all depends on the applications and the usage scenarios. For example think of an e-mail system like Gmail. There is a possibility that a student is presenting a presentation on a professors laptop and needs to get his/her slides that were e-mailed to himself/herself. This is a case where the individual would want the password field to be masked, because everyone could see the password on the projector otherwise.
    – Waleed Al-Balooshi
    Aug 17, 2010 at 20:25
2

The point of asking a user to type their password twice is to ensure that there are no accidental spelling errors in their password. If you skip this step and they did spell something wrong, they would have to go through a whole password recovery/password change process, which can take a while depending on security requirements/user abilities.

I personally feel that just one user having to go through password recovery because of an extra character/missing character/etc is one too many. Especially when retyping the password is such an easy step. Of course some people will copy and paste the first into the second, but that is their fault. I did my best to help the user avoid that issue.

Improve this answer
6
  • It's better for the user to give a link to just show the characters while they type.
    – Glen Lipka
    Aug 17, 2010 at 16:09
  • You can't copy from a password field. :-)
    – Patrick McElhaney
    Aug 17, 2010 at 17:48
  • I know where you are coming from but I really think I have done this before. I can't put my finger on it. Perhaps the form was a standard input field with custom character masking?
    – LoganGoesPlaces
    Aug 17, 2010 at 18:04
  • I feel that the one person who made a typo and has to go through the password recovery process should not cause thousands of other users to make an unnecessary step.
    – idophir
    Aug 17, 2010 at 19:30
  • If only it were just one person. When I was trapped on a helpdesk, the majority of calls were for password related issues. So maybe the whole system is broken anyway?
    – LoganGoesPlaces
    Aug 17, 2010 at 21:16
2

It's largely subjective and it greatly depends on how your signup process is designed. If the email is confirmed and you have a solid "recover password" process then I would suggest probably not.

If you have total control over the UI (ie. not web), you might also consider allowing the user the option to see what they are typing (á la this)

Improve this answer
1
  • 3
    Why can't you do that on the web? You can do the exact same thing on the web with only a minimal amount of effort. In fact, your demo is on the web, isn't it?
    – Charles Boyung
    Aug 17, 2010 at 16:36
1

So I think as almost always the answer is: It depends.

As others have said: If you aren't going to be sending the password back to the user or make recovery very easy, than having a double password can be an effective way to avoid user-error (typos specifically). I have fallen prey to typos on several occasions; I think with requirements for capital letters the number of typos goes up, but I have nothing but my own anecdotla evidence to prove it.

I don't think you should make this decision based on percieved cost: If I have to create a new account I no longer get my preferred name/username and end up with some weird numeric addition, which itself becomes difficult to remember. Also the percieved cost to anyone of us will probably be lower than the average user.

I really like the iPhone metod of showing me just the last character I typed. It does a fairly good job of giving obsfuscation and information in just the right amounts to people who are probably entering in passwords in public places.

I still use the double-password, I'd prefer to err on the side of limiting user error; it's not as bad as the double email.

Improve this answer
1

I initially thought "if your users are not very savvy, a repeat password field helps them avoid errors". But, on the other hand, users that are not computer-savvy might be horribly confused by the second field. After all, in the real world, there is no such thing as repeat fields.

I think the nicest option, but harder to implement, is to not have a repeat, but include a "do not mask my password" box.

Improve this answer
1
  • Most people will just fill out the second password field without bothering. If you really want to educate them, make the label clear, add a little explanation or add a “why?” link/popup/...
    – Peter Frings
    Mar 2, 2011 at 8:19
1

I worked on a project where users didn't have to repeat the password. One day we got an angry email from a user who claimed that we displayed his password - in clear text - in the upper right corner.

It turned out that when he signed up he had entered his password, and then without looking up, tabbed on to the next field and repeated his password. Except that field was 'First name'.

He wasn't stupid, nor was he not paying attention. He was displaying something that we designers should strive for: Habituation. It's like a turbo switch in the user's head, except you can't always control things at high speed.

There are at least two broken things here

  1. Having to create an account in the first place (use openid, google, etc)
  2. Using passwords for authentication (no real solution yet)
Improve this answer
1
  • 2
    One problem with this - you say "nor was he not paying attention". Sorry, but you are wrong there - if he typed his password into the first name field, he clearly was not paying attention.
    – Charles Boyung
    Mar 1, 2011 at 14:25
0

Good question! I've been thinking about two ideas:

  1. Start off hiding the passwword. Give the guy a toggle button that will unhide/rehide the password as he's entered it so far.

  2. An unhide timeout might work: provide a button that will reveal the password for a half-second or so, then re-obscure it.

In both of these, the user enters the password just once. And he sees a message (not necessarily a prompt, but maybe it should be) to reveal and inspect the password before submit. As a backup, there's always (I think) the guy's email for password reset.

-- pete

Improve this answer
0

No it is not necessary.

It depends on how important the security of the website is, what impression about security you with to give the user and how strict your password requirements are.

For websites that require passwords to contain certain patterns/numbers/letters, then your best to have the user repeat the password, as my experience has been they are authoring a new password. So what they think they typed might not be what they entered.

For websites of leisure, is security really that import? Most likely not, and you might be dealing with the hit and run user sign up. So reducing the effort and time helps to improve your sign up conversion numbers.

For websites offering paid services, then the user has already made/completed the purchase decision. Signing up is just the a process they need to complete to access the service. Double prompting helps build trust that they can access this service they paid for, later. No one wants to reset their password for something they $paid$ for.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.