9

Standford University recently published a quick guide to their password requirements:

enter image description here

While I quite like this method and this guide is great, I can't think of a nice way to concisely express this information inline to a user when they are entering a new password.

Does anyone have any suggestions on how you could communicate these requirements to a user based on what they have already typed? In particular, what would you display to the user if they had already typed in 5 all lowercase characters?

  • 1
    Why not just use a password strength indicator. It encourages people in real-time to use more complex passwords, but doesn't force the case. You can always have a ? button to show user the full requirements such as this, but it just makes things more complicated really. Don't tell them what to do, guide them instead. – JonW May 23 '14 at 12:41
  • 1
    @Renaud I think you have a valid point, but I'd expand it to say "hacked" instead of "hacked because of ___". I think in general you're right, passwords simply aren't hacked anymore, they're just stolen in gigantic chunks. – Perchik May 23 '14 at 17:33
  • 1
    The text in the bottom half of the ellipse at the top of the graphic seems pretty concise... – Marjan Venema May 23 '14 at 17:34
  • 1
    While brute-forcing character-by-character is defeated by long passwords, using common words to build a long passphrase still leaves users open to dictionary-based attacks. – mouseas May 23 '14 at 19:25
  • 2
    @JonW The problem with password strength indicators is that most people misunderstand what a strong password is. They tend to add more "odd" characters rather than increase the length - when length is often the "best" option. – adrianh May 25 '14 at 7:54
9

I'm not sure about their requirements and if they match yours, but Simple (simple.com) did a pretty great job with just the use of the word "passphrase". If you lead with that word and then gave a inline example like you've done at the bottom of your infographic, that might test well.

passphrase too short

passphrase gets a B

a good passphrase

This also might go against your requirements, but if what you want is the passphrase with the longer character count, I'd stay away from letting the user chose between lower characters with more multivariate character types and the longer passphrase. I'd just promote the behavior you want them to follow.

3

I wish I could remember which site it was but I saw one registration form that did two things:

  1. It had an estimate of how long it would take to crack the password.
  2. It gave examples of how you could make it better

So you saw something like:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.