Anyone has research or data that shows correlation between using password complexity requirements and sign up conversion rate?

Example of password complexity requirement:

enter image description here

  • 1
    It can't contain special characters? Why not? ... Also, if you haven't already, check out Does a password strength indicator increase password strength?. Some interesting information in the answers there. Apr 14, 2014 at 17:46
  • It's likely that error feedback for incorrect entries will play a large part in abandonment (i.e. "your password is incorrect" with little feedback for which rule has be violated or the error showing up at the top or bottom of the page). I have no hard numbers so I won't provide an answer, but my money is on abandonment being high if desire doesn't match complexity. In other words, banking apps likely have a higher tolerance for complexity, whereas purchases for non-essential items will likely be abandoned. It's safe to safe this is universal for conversions of any kind (see Amazon checkout).
    – glilley
    May 10, 2014 at 18:13
  • I think even if there is, the effect that this has on the user might depend on the type of application that you are building. Applications where people expect to have a higher level of security/privacy might actually benefit from having a stronger password requirement.
    – Michael Lai
    May 27, 2014 at 22:54

3 Answers 3


It's tempting to just cite this: https://xkcd.com/936/

... But maybe this study is more in line with your question. That directly addresses password security relative to user resistance (though maybe not conversion rate). It does so in the context of comparing password security models, which might go even further to answer your question.

Essentially, the xkcd punchline is supported by the Carnegie-Mellon study: "Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess."

Password security modeling partly depends on the scenario you are defending against. But we seem to be coming down to resisting brute force attacks, for which you just need as much entropy as possible. That just means more characters, and we can stop torturing users by forcing them to expand the character set to special characters, numbers, etc.

The xkcd example in which "Tr0ub4dor&3" would take 3 days to crack at a certain level of hardware, and "correct horse battery staple" would take 550 years at the same level, is a good example.

The CM study does show that as of 2010 there was slightly added user resistance to a 16-character requirement, but that's very possibly a sentiment that can shift over time, and users may have been assuming they still needed to avoid dictionary words or include a variety of character types because of previous experience. For those users, it's just a longer version of the things they already didn't like about creating passwords.

But as we move forward and set friendlier expectations, in friendlier ways, that might prove to be a minor resistance that was only temporary. Even "correct horse battery staple" is in fact no more secure than "wow the lawn is really green" and much harder to remember, so advising users to create a mnemonically memorable sentence related to the site may actually flip the long password requirement to being a positive experience.

All the normal practices for a) giving clear parameters up front and b) graceful error states remain true, but a lot of them are less needed if you get rid of all the cruft that grew up around password criteria that turns out to be non evidence-based.


I think one should always expect the dumbest user (we everyone have our dumb moments ;) ). So, make the minimum restrictions, and explain what's wrong. I suggest using little absolute restrictions. Instead I would use a formula that evaluates the risk of the password, and if it's high explain the main problems to the user.


User types "password123", system says:

«Your password it is too risky:

  • Avoid common words (like "love", "pass", etc.), and better, avoid words.
  • Avoid common numbers: repeative (333,888,etc.) or consecutive (123,876,etc.).
  • Read our suggestions to make a easy but strong passwords.»

Where to start:


I wouldn't overthink this problem -i.e., don't wait around for a study that shows the bounce rate at the point of entering password.

You can trust that if people are willing to enter a password, they will not change their minds because you've added a few security features. It is safe to assume that people have their go-to password that meets most requirements - unless you are dealing with a primarily 60+ crowd, and then you need to be very forgiving when it comes to password creation anyway.

That being said, you can make friends with them if your experience isn't overbearing. They won't take off, but they might build a little animosity toward you if you act like a password nazi. You can help their brains along a bit by:

• Chunking: Give 1-5 rules for the password, no more than 5, and the fewer the better.

• Avoiding crazy rules they've never seen before. (The above example has a couple that are unordinary)

• Giving them a mobile-friendly size of field to create their password and a nice clear submit button.

  • What I would add to this is the ability for single sign on using other social networks. I've seen some services put up odd password requirements. I've dropped out unless there was a Facebook, Twitter, Google connect. May 14, 2014 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.