7

When allowing a user to change their password is it necessary to add a confirm password field?

as follows:

  • Current Password
  • New Password
  • Password Strength Meter
  • Confirm New Password (Is this field necessary?)

If the field is necessary why so?

Currently sign-up forms are doing away with confirmation of passwords and email. So would this apply to a change password form, not to have the user enter repetitive information?

Improve this question
1
  • 1
    Every time I use a password change form that doesn't allow me to confirm my password I reconsider.
    – MildWolfie
    Commented Oct 23, 2014 at 14:58

2 Answers 2

Reset to default
3

Currently sign up forms are doing away with confirmation of passwords and email.. so would this apply to a change password form, not to have the user enter repetitive information?

The function of repetition of passwords is the same in a sign-up form as it is in a change password form. So, given the judgment that there is no need for repeating the password when signing up, the same should apply to changing the password.

That said, I'm not convinced that confirmation of the password should be removed in the first place. There is no way to see that you entered the password wrongly, and that is a real possibility--especially with increasing requirements for strong passwords, as well as more people using touch screens. Consequences:

  • When the password is entered incorrectly, it is a hassle to change.
  • The user might not realise their mistake, instead assuming the site is broken and wondering why they can't log in. This potentially creates support problems.

The repetition of email addresses is another thing (ARGH!). It is pretty annoying to have to do this when you can see the address on the screen. But I still favor asking for the password twice.

Improve this answer
1
  • I agree completely. The "pain" in repeating the password to make certain that it was not entered in error is trivial to the problems that occur when you are unable to login (due to you making a mistake when entering the password.) The only counter to that is IF it's VERY easy to redo your password. 1. CLICK "Forgot Password" 2. Go to txt/email 3. Go to Enter New Password screen. +1
    – Mayo
    Commented Oct 23, 2014 at 13:33
3

It is necessary because you are masking the field so the user has no way of validating the input.

Alternatively, you can drop the field and unmask the password. FYI password masking is a thing of the past and a major bugbear of mine.

edit: as jon W says, include checkbox to toggle masking.

References:

Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures. http://www.nngroup.com/articles/stop-password-masking/

While masking passwords is a good security practice, there’s a chance it could jeopardize the user experience of your sign up form. When users sign up on a website, they expect a no-hassle, worry-free form to fill out. But masking their password could prevent that. http://uxmovement.com/forms/why-password-masking-can-hurt-your-sign-up-form/

...The situation is even worse on mobile where small screens and imprecise fingers are the norm. http://www.lukew.com/ff/entry.asp?1653

Improve this answer
8
  • Most users will experience an unmasked password field as being unsafe.
    – Sherlock
    Commented Oct 23, 2014 at 9:17
  • 2
    An alternative to just unmasking it is to have a 'Show Password' checkbox so the user can toggle the visibility of the contents.
    – JonW ♦
    Commented Oct 23, 2014 at 9:30
  • "password masking is a thing of the past" Umm, what? Why would you assume there is no one looking over someone's shoulder when they type the password? That is more of a problem than ever with the abundance of mobile devices. -1 for not only stating this opinion but making it sound like a widely accepted position, which it most definitely is not.
    – user31143
    Commented Oct 23, 2014 at 9:44
  • " problem than ever with the abundance of mobile devices" its hard enough to lurk over someones shoulder and spy on them in desktop mode, absurdly hard on mobile when you're, well, mobile.
    – colmcq
    Commented Oct 23, 2014 at 13:20
  • 1
    @colmcq, it's not just mobile phones. Tablet and laptop use in public places is quite another matter. I still don't agree with your position, but removed the downvote since you added some references.
    – user31143
    Commented Oct 23, 2014 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.