I know there's been a lot of discussion about password strength and indicators when signing up. I often find that when I forget a password for a site, its because I can't remember which set of rules were in place for that site (ie, >10 chars, special chars, no numbers) and if I knew those rules, Id remember which algorithm I used for my password.

To me, it seems like it's worth giving the user a hint about what the password rules were, before forcing them to go through the whole forgot password process. I'm finally able to implement something like this on our site, but I was curious about the UX of it.


download bmml source – Wireframes created with Balsamiq Mockups

With that said, has anyone seen this done in practice/know of a reason not too?

Edit 1:

I've often thought the argument against this falls under the vague umbrella of security-- "If we display this information it will be easier to crack the password"-- but I can obtain the same information by attempting to create a new account

  • 1
    Microsoft at least does (sort of)--if you enter a password longer than 16 (which they infuriatingly don't auto-truncate for you) it at least warns "hey enter just the first 16 characters". Unrelated, but don't limit your passwords to 16 characters.
    – Ben Brocka
    Apr 16, 2014 at 14:32
  • Interesting! That's tangentially what I'm after. If you don't allow special characters, tell me that when I try to enter a password with a special char, instead of just telling me the password is "invalid"
    – Perchik
    Apr 16, 2014 at 14:37
  • 1
  • Well, that settles it. I searched for awhile before posting, but it looks like this is a repeat of that question. Thanks
    – Perchik
    Apr 16, 2014 at 15:46

1 Answer 1


I think this is quite a long shot to expect users to remember their passwords base on the password complexity requirements. I don't think this would be a security issue though, since hackers could just go to the signup page and find out from there what the requirements for passwords are.

On the other hand, I know that when I forget a password it's sometimes because the website has asked for an unusually complex password. In that case I need to change my usual password (bad practice but that's what people do). So when possible, I would try and stick to something that is a standard : min 8 characters, at least one number, at least one letter. But again it might now be sufficient for banking sites, etc.

  • For me, it's much easier to recall the password when I know the rules. Many sites have no requirements on password strength, therefore I'm always surprised that on one specific site I have a stronger password than I would likely use if the restrictions did not exist.
    – yo'
    Apr 16, 2014 at 20:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.