This question has been raised on https://security.stackexchange.com/questions/40723/why-do-you-need-to-login-after-you-change-a-password - With security in mind

As one user states: "From a security point of view, whether the "password reset" logs you in automatically or not is rather neutral."

So why do we enforce the user to re-type the same email and password just provided by the user?

Reset password:

Email -> Unique token -> Set a new password -> Redirect to login page -> Type in email again -> Type in password again -> Log in user

instead of

Email -> Unique token -> Set a new password -> Log in user

1 Answer 1


Now that I know it isn't for any security reason, I'll fall back on the reason being tradition, ignorance, and laziness.

Okay, maybe someone thought if you make the user enter the password again (possibly the third time after entering it twice to reset it), the user is more likely to remember it. I don't know if that is really a net gain for the user or not. I'd guess not.

But, no, I suspect tradition, ignorance, and laziness. Not every design is for a reason. Sometimes the "designer" is just being mindless, then other designers mindlessly copy it.

One system I use displays a "password reset successfully" page after you reset it... and nothing else. No login page. Not even a link to a login page. The user has to click Back repeatedly to find the login page. The whole app is rife with UX WTFs like that.

  • A question to ask is if UX WTF's are good for the users, even though the solution works better on the paper
    – Velkommen
    Nov 11, 2014 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.