I'm building a mobile web app that will request a bunch of information from the user (name, dob, address, etc) and am trying to cut down as much fields as I can.
I've noticed a new trend where mobile webapps don't request password confirmation and instead just show the password field in cleartext.
How is this perceived by the users? Does it not give a sense of insecurity?
There are indeed many apps that have dropped the password confirmation field, but I'm not sure they have also switched to showing the password.
I think not having to confirm the password is a good thing:
So I would still show the field starred, but if you like, you can have a link or a switch saying "show password" (some password managers do that).
I wrote about this a while back: Fixing Registration & Login Forms – Passwords
Look at what Twitter does - they just ask you to choose a password, nothing more.
For mobile, I would say that the concerns that masking attempts to address are even less important. How likely is it that someone will be watching you type your password when using your mobile device? Even less likely than if you are using a laptop/desktop. Because of this, I really think just using a single normal text field is the best way to go for mobile. (I feel the same way for non-mobile, but that's a different story)
I don't know the history of the masked password field and why it's become the norm other than I can see it making sense at first glance.
But it's REALLY annoying...especially on a mobile device where typing is difficult and you are constantly checking for spelling issues.
So, just the opinion of one web user, I'd rather all password fields be readable and not masked.
One option would be to mask by default, but offer a way to see it:
[ * * * * * ] ( ) show password
The only advantage to using an actual password field may be that the device won't automatically attempt to spell check it for you. It'd be interesting to know which devices do that and if there are ways to turn that off on a field-by-field basis.
autocapitalize and autocorrect properties for the <input> tag (set them as off) and it turns the field into a perfect, clear-text password receiver. Good for email too :-)
Commented
Apr 21, 2011 at 18:22
Different mobile OS handle password display differently. For instance Android phones have a User setting that allows the user themselves to choose whether the password is displayed or hidden, whereas iOS does not (so all masked password fields are hidden).
You can probably bypass this option when setting up the form by not setting the field to Mask, but you should include a checkbox near the password field ('Hide My Password' for example) which, when checked, will turn on the Masking and hide the password.
Masking passwords is a convention that adds to the feeling of security for users, although at a detriment to usability.
I agree: Stop making people confirm passwords, especially from Mobile.
Second, yes, display in Plaintext. Some good reading on password security and masking:
http://www.nngroup.com/articles/stop-password-masking/
It's time to show most passwords in clear text as users type them. Providing feedback and visualizing the system's status have always been among the most basic usability principles. Showing undifferentiated bullets while users enter complex codes definitely fails to comply.
...
Users make more errors when they can't see what they're typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business. (Or, in the case of intranets, increased support calls.)
The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security.
Abandon Legacy Design Password masking has become common for no reasons other than (a) it's easy to do, and (b) it was the default in the Web's early days. In this respect, it's similar to another usability problem — having Reset buttons on forms, which is also something that should die.
Apple has done an excellent job of this on iOS devices and there are certainly mechanisms to accomplish this in the wild.
http://blog.decaf.de/2009/07/iphone-like-password-fields-using-jquery/
The way a password is viewed/stored is a usability concern of browser developers much more so than web developers though.
Make the password field clear text by default
[MY-COMPLEX-PASSWORD] [Hide]
Please make life easier for users
