I'm trying to think of the 'best' way for a user to change its password along with its user settings(Like name, e-mail etc.)

I've got a form like this:

Name: [text input]
E-mailaddress: [text input]
Change password: [checkbox]
    When checked show:
    New password: [text input]
    Repeat password: [text input]


Now, this doesn't seem as a very nice approach, it requires clicking a checkbox in order to let the user change its password.

I'm thinking that just showing the password+repeat password fields but make them optional would be better:

User settings
Name: [text input]
E-mailaddress: [text input]

Change password (Only if you want to change your password)
New password: [text input]
Repeat password: [text input]


What do you think is the best approach?

  • 2
    Usually the user should enter old password before entering new one, otherwise someone could change it if the user forgets to log out. Otherwise 2nd option is better, IMO less actions required.
    – Igor-G
    Commented Apr 29, 2014 at 10:44

1 Answer 1


I'm not sure what kind of site this is for, but you should always do a check to make sure the user knows their old password and if they don't do a verification to their e-mail. This will make the account area more secure and less likely for users to permanently lose their account to hackers or their own mistakes. For example if you were to edit the form to look more like:

Name: [text]
E-Mail: [text]

Change Password (Only if you want to change your password)
Current Password: [input text] (forgot password?) ---> this would send a link to their e-mail helping them reset password.
New Password: [input text]
Confirm Password [input text]
  • If I would leave my desktop open to the public and kept open my application in which this can be changed. Wouldn't a password reset be dangerous. Since chances are my e-mail is open/available on the same machine?
    – SlaKrop
    Commented Apr 29, 2014 at 13:22
  • That could pose a threat yes, but most times people that you know would already know your e-mail address as I'm sure they have e-mailed you before and they still do not have the Current password or your e-mail address password. So it poses no more of a threat then telling someone your e-mail address so that they could contact you.
    – Nick_M
    Commented Apr 29, 2014 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.