I have a hypothesis that I have no idea how to test other than lots of observational testing, but perhaps someone has covered this already.

On signing up to a new service and being presented with the Choose your Password field, almost all users never read the password rules before entering a password. They already have a password in mind before signing up to the service, so all they do is type in their chosen password and then use the site feedback to tell them whether it passes validation or not.

Has this hypothesis been supported in any way?

I'm trying to support a case that there is no need showing the password requirements to the user unless the password they enter is invalid for whatever reason, but I wanted to find out if displaying those rules is actually potentially useful, and that it would cause a negative experience if I were to bin them off.

  • 1
    Hi @JonW - Hmm... this is a little generalised. Never is a strong word. Is it ever useful? Yes - to some. Is it always useful? No - not to everyone. The questions are: Where is the line? How blurred is the line? What have you got to lose? and How could you present it more usefully, more accessibly, and more engagingly? Commented Jan 21, 2015 at 13:28
  • 1
    OK, I should probably pick better wording here. Nothing is ever so binary as always/never in UX.
    – JonW
    Commented Jan 21, 2015 at 13:38
  • @RogerAttrill there are already questions about how best to display such rules (ux.stackexchange.com/questions/43925/…) I'm just curious as to whether it is a likely possibility that even a few people wait to see some password rules before they even choose a password.
    – JonW
    Commented Jan 21, 2015 at 13:39
  • If you want some anecdotal evidence, I use LastPass and use the information given by service providers in those password requirements to let it generate the most secure password possible for me. I'd strongly recommend always showing the requirements for other security-conscious people like me. Commented Jan 21, 2015 at 14:11
  • @RyleeFowler How does lastpass know what the requirements are for all the different service providers?
    – JonW
    Commented Jan 21, 2015 at 14:16

4 Answers 4


Well, it's a bit of a "dirty" manipulation that could direct a user's potential dissatisfaction at himself rather than at the system :).

A user arrives at page, creates an invalid password, gets an error message that says "The password must be over 8 chars". He looks for the password rules on the page. If he doesn't find them, he becomes angry with the system - "How did they expect me to guess the password rules if they don't even display them?". If he does find them, he thinks "Oh, right, I didn't read the password rules and there it was right in front of me. My bad".

The fact that nobody reads them doesn't mean that we shouldn't do our duty and try to prevent a mistake instead of merely letting them recover from it. It's like a salesman who doesn't show up for work because he knows that there won't be any customers :).

There's another angle to this, too.

Say that we don't display them and the user fails requirement A. Do we just display requirement A or do we display the whole list? If we just display the one that he failed, we're beginning a guessing game, where he might fail more requirements later on, and get more messages. This is pure evil. If we do display them, we're overwhelming the user with a long and unfriendly checklist, where hopefully the failed requirements are highlighted. In any case it's not a nice surprise, and it would be better if he saw the requirements upfront.

Lastly - many users are tech-savvy and would wonder about the requirements if they don't see them. Saying "ok, you should get one wrong before we show them to you" is pretty unpleasant.

  • I would wonder if catering to this fringe case is going to annoy more people than it helps though. Throwing up loads of text noise to everyone just for the benefit of this one person who might get annoyed that the requirements weren't displayed to them (an who might not even read them had they been displayed) might not be such a great option.
    – JonW
    Commented Jan 21, 2015 at 14:32
  • What makes you think that it's a fringe case? Users know that passwords must meet certain criteria. We don't know how many of them read the requirements. There's a pretty wide consensus that says that error prevention is preferable to just easy recovery (e.g. Nielsen recommends it). Commented Jan 21, 2015 at 14:41
  • It may be a fringe case, it may not. That's kind of what I'm looking to find out here. While your user scenario there is potentially accurate, it is still just an assumption (admittedly as is my initial hypothesis too.)
    – JonW
    Commented Jan 21, 2015 at 14:43
  • 3
    But it didn't turn out yet. Neither of us has the data, and in the absence of data displaying the rules is the safer path, because they at least get the option to read the rules. Hiding the rules makes sure that exactly 0% of users read them. The error rate will by definition be higher (unless you're operating under the assumption that noone reads them ever. I can assure you that this is not the case, because I read them sometimes :) ). Commented Jan 21, 2015 at 15:02
  • 1
    Most people simply don't care about password requirements, and have no interest in them. If a password requires mixed case, a letter and a special character, the vast majority of the time, mysecretpassword becomes Mysecretpassword1! and any dictionary attack can account for that, virtually negating the additional security
    – Jon Story
    Commented Jan 21, 2015 at 15:03

Let's assume that Yes no one reads them!

Although it is a very good point you bring "They already have a password in mind before signing up to the service", but the solution would be to improve them so users read them, not to hide them and force users to play a guess game that could be very annoying resulting in abandoning your service!

We should think of ideas that improve the presentation of those requirements, make them more readable, easier to scan, and spotted at a glance.


Anecdotally, I personally use the password requirements listed to generate the strongest possible password with my password manager. I find these very useful, and they immediately tell me if I need to turn off special characters or if I get to leave them on, if I need to reduce the length of my password or if I get to keep it long, etc. As an addendum to this, I also prefer to know if my input is going to pass initially rather than fail and be thrown back to the start like it's my fault I didn't follow the invisible guidelines.


This is difficult to test because there is very little information you can use to tell whether the users coming into your website are using strong passwords already or not. One way I can think of at least trying to work out the potential behaviour is if you can measure the amount of time people spend on the 'enter password' field before they click submit, and how often it fails the password strength validator. If you also add to the analysis the amount of times they enter potential passwords into the field before they are successful, it should give you some preliminary data to look into more detailed research if you want to improve or change the design.

What you can then do is to compare the figures when you show the password rules and when you don't show the rules and see if there's any difference. I think best practice is to have some indicator of password strength (there are many examples on the web) so it reduces the amount of times that a user has to attempt before reaching the required password complexity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.