Any evidence password strength indicators break user journey?

Question

Have any studies been conducted on whether password strength indicators break user journey's. Here is a hypothetical scenario:

As a customer of an eCommerce website, I am ready to make a purchase and begin the registration process in order to complete my order. I am faced with a password strength indicator whilst creating my user profile and discover my usual password is weak. I think to myself ‘blimey, I use this password for my bank and my online pension admin too. I best go and change them as a priority’. I then proceed to leave the eCommerce website and handle the change of passwords on these top priority accounts.

My question therefore relates to whether password strength indicators can be a distraction to the user journey, causing users to panic and correct passwords elsewhere.

Answer 1

This is a very interesting, albeit micro scenario to consider.

In the case that you provide, I'm a huge fan of account creation only after a shopping cart purchase has been finalized. This can even include an action/request by the user before the "purchase" button is hit (such as 'please create an account for me after purchase' checkbox next to an email/username field on checkout), but should really only involve the password input request after the order is complete.

In e-commerce, this could involve an order thank you page that also requests the user now set their password with copy along the lines of 'just one final step is needed!' This is where the verification field could then be displayed, therefore definitely making the incomplete action scenario you describe above very unlikely.

I guess 'very unlikely' is about the best we can get as UX creators, but that's part of the fun :) Right?

Answer 2

I think the scenario you describe is very unlikely to happen. The user will finish his current goal at the eCommerce, before he attempts to change other passwords.

It is true though, that the password strength indicator will be a distraction that will consume user's attention and may also cause anxiety. But this is a matter of trade-off between enhancing the security of the site (and also the perceived security by users) Vs fewer distractions on the user's main goal.