9

Standford University recently published a quick guide to their password requirements:

enter image description here

While I quite like this method and this guide is great, I can't think of a nice way to concisely express this information inline to a user when they are entering a new password.

Does anyone have any suggestions on how you could communicate these requirements to a user based on what they have already typed? In particular, what would you display to the user if they had already typed in 5 all lowercase characters?

Improve this question
8
  • 1
    Why not just use a password strength indicator. It encourages people in real-time to use more complex passwords, but doesn't force the case. You can always have a ? button to show user the full requirements such as this, but it just makes things more complicated really. Don't tell them what to do, guide them instead.
    – JonW ♦
    May 23, 2014 at 12:41
  • 1
    @Renaud I think you have a valid point, but I'd expand it to say "hacked" instead of "hacked because of ___". I think in general you're right, passwords simply aren't hacked anymore, they're just stolen in gigantic chunks.
    – Perchik
    May 23, 2014 at 17:33
  • 1
    The text in the bottom half of the ellipse at the top of the graphic seems pretty concise...
    – Marjan Venema
    May 23, 2014 at 17:34
  • 1
    While brute-forcing character-by-character is defeated by long passwords, using common words to build a long passphrase still leaves users open to dictionary-based attacks.
    – Mar
    May 23, 2014 at 19:25
  • 2
    @JonW The problem with password strength indicators is that most people misunderstand what a strong password is. They tend to add more "odd" characters rather than increase the length - when length is often the "best" option.
    – adrianh
    May 25, 2014 at 7:54

2 Answers 2

Reset to default
9

I'm not sure about their requirements and if they match yours, but Simple (simple.com) did a pretty great job with just the use of the word "passphrase". If you lead with that word and then gave a inline example like you've done at the bottom of your infographic, that might test well.

passphrase too short

passphrase gets a B

a good passphrase

This also might go against your requirements, but if what you want is the passphrase with the longer character count, I'd stay away from letting the user chose between lower characters with more multivariate character types and the longer passphrase. I'd just promote the behavior you want them to follow.

Improve this answer
3

I wish I could remember which site it was but I saw one registration form that did two things:

  1. It had an estimate of how long it would take to crack the password.
  2. It gave examples of how you could make it better

So you saw something like:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.