I am designing a secure password login page. I am thinking about outputting multiple * for one typed character.

For example: User types: a
Password field shows: ******

My rationale for this is somebody looking over your shoulder wouldn't know the password length. What are the advantages and disadvantages of using this?

  • 1
    Unclear feedback on if a key was pressed or how many keys were pressed you think is a good UX? – paparazzo Dec 7 '14 at 19:44
  • 2
    Why display it at all in this case? – user42005 Dec 7 '14 at 20:00
  • Indeed, in *nix systems terminal it isn't shown at all. – bigstones Dec 9 '14 at 6:30

If you're talking about while the user is typing, I would highly recommend against this. The user will think they are mistyping the password since the mask won't match what their trying to type, and it will cause frustration for the vast majority of your users. The "shoulder surfing" risk is not worth the UX pain (especially if you are enforcing a minimum length to passwords).

Now, if you're talking about displaying the user's password later, using an arbitrarily long mask does hide the password length (but then what's the point in displaying it?). But you were specifically mentioning during login.



I would find this annoying as a user: if you make a mistake in typing your password most often than not it's due to having added or omitted one character, and this is especially frequent on mobile apps, so being able to at least doublecheck the entry before sending it is quite useful.

Also, I doubt it is really needed - if someone is trying to look over the user's shoulder actually being able to count the number of characters would be quite a challenge in itself (distance, all characters identical), unless the pwd is comically short (3-4 characters) which is something you should not allow anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.