17

When a user submits a reset password form, which UX is preferred?

  1. A temporary password is created for them to use. It's emailed to them. They log in and then a permanent change password form is shown.

  2. A link is emailed to the user that takes them directly to a change password form. The link has a unique id in the URL (which also expires).

Note: in neither situation is the actual password changed until the user completes the steps in the password reset email.

  • 5
    If you think about the password being a unique ID that can be placed in an URL, it’s pretty much the same; except that clicking a link is a lot more convenient than entering a password that isn’t yours. – poke Jan 21 '15 at 21:50
  • 1
    Why not both? After the user request a new password, show a page where they can enter the code you send them via mail. In the mail is also a link that directs the user to the same page as if they enter the code there... – Johannes Kuhn Jan 23 '15 at 20:15
  • @JohannesKuhn I could try that to see which method is preferred. Perhaps there could be two version of the email: one where the reset link is shown first with the temp password underneath as an option. And one where the temp password is shown first with the link underneath as an option. – jrjensen Jan 23 '15 at 20:20
  • 1
    Microsoft uses a code, google uses a link. – Johannes Kuhn Jan 23 '15 at 20:29
  • 2
42

It's better to send the reset link for 3 reasons:

  1. Users don't need to remember a temporary password and they don't experience copy/paste issues.
  2. Most users don't remember their password because they haven't logged-in for a while, so usually don't remember how to change their password.
  3. It requires less activity.
  • 6
    In addition - sending a temporary password is still sending a password in plain text via email. While you can't protect a user if their email account has been compromised, sending a link is still better than sending an type of password in plain text. – JamesEggers Jan 23 '15 at 18:57
  • 12
    Also consider touch screen users. It's easier to press a link than it is to copy text. – Chris Jan 23 '15 at 19:31
  • 8
    Also want to point out another reason: Somebody other than the actual user may potentially initiate the request. You don't want to just change the account password and potentially lock out a user. Some reset password emails (e.g. dropbox and Twitter, I think?) specifically mentions "If you did not make the request, feel free to ignore this email" presumably because they've seen this happen frequently enough. – nightning Jan 23 '15 at 20:47
  • 1
    Agreed, it also has security related issues security.stackexchange.com/questions/32589/… – Ades Jan 27 '15 at 9:55
  • 1
    Also, depending on the characters in use, most password resets that are of a plain-text variety tend to use l and 1, O and 0, 5 and S, and so on, or, even if they exclude some combinations, rarely bother to tell recipients which are the right characters. – phyrfox Jan 30 '15 at 3:33
18
+125

Usability Implications

  • A link is much more accessible. I can get to a link via click, tap, or with the keyboard easily; and in a confined device like a smart phone the process of opening the site in question is much smoother and easy. If I have to select, copy and paste a password from an email I need to be a little more dextrous, especially on fiddly little devices

  • Password reset links look more secure. Compare a little string of password data exposed as text in an email compared to a long hash link which isn't even an actual password and think of the mental effect on the user. Regardless of the actual security implications of either technique, any intelligent user is going to think that they are in more secure hands with a reset link

  • This blog post talks about a problem with both techniques, that the user may not have the same access to the email address they used for your account, causing a chain reaction of password related pain as they try to access that account, reset it's password ... secondary verification measures like secret questions or two step verification should be available too.

  • Password reset and send also has another implication as detailed in this blog post - a system that changes a password simply by providing an email address gives anyone the chance to lock someone out of an account without knowing a password. Say this is combined with an inaccessible old email address (or use of a username rather than email address in the form, meaning they might not even remember which email address they have used), the user is then unable to go and retrieve the password from their old email address. A link doesn't have this problem as the password is only reset when the link is clicked. Similar to this is the case where a user clicks to reset but then actually remembers. If the link is not used they can still get in without going to their email address.

Security Implications

  • A link is also a forced expire. It will only work for a preset length of time (say 15 mins or some such). Although you can force a user to enter a new password after using a temporary one, this stack exchange question, backed up by this general principle of human behaviour suggest that there's a pretty high chance the user will just use the temporary password, especially if you made it short / memorable enough. Bear in mind that they may well do this thinking 'it's OK, it's saved in my emails'. There are ways round this, like not letting them re-use that password, or making it fail your general rules etc. but all of those ideas will make things more difficult for them.

  • Email addresses are often now linked to phones and other mobile devices. A common feature with these devices are 'push notifications' where a message pops up on the screen. Crucially, this even happens and is visible, often with a summary, on the lock screen of the device, meaning you could actually leave someones device sitting there with the email address and the password in plain text on screen for anyone devious to see. A link cannot be clicked from a lock screen as it would require the device to unlock and load a browser.

Conclusion

Absolutely use a link.

9

Sending a password at any time for any reason is bad UX.

This applies equally to email and sms text messages. Even if the password is temporary it can lower the credibility of your brand. Building a relationship of trust is one of the most important things we do and emailing passwords always feels wrong.

When sending a reset link it is also important to let the user know that the link itself will expire after a certain period of time (30 minutes - 1 hour). This is okay because most people requesting a password reset are doing so because they are trying to log in right now and having clickable links in email that reset passwords indefinitely is just as bad as sending out temporary passwords.

Finally, make sure the system that sends out the reset email is very reliable and fast. Users don't want to wait around too long for an email telling them how to proceed and may even request multiple resets if the system doesn't perform fast enough. The issue is compounded when the first reset email link arrives after the reset button is pressed a second or third time resulting in a link that no longer works even though it appears to the user it should. Be sure to let the user know when to expect an email as soon as they click the password reset button in order to properly set expectations.

  • 3
    showing password anywhere is really not good and it decreases the trust of user of the website. – Imran Jan 26 '15 at 13:18
4

Sending a link is a way more better because:

  • Sending a password in an email reduces trust.
  • It is hard for the user to remember it (mostly it will be a combination of some letters/numbers/special-characters, producing a word that makes nosense)
  • Fewer steps by far (which is a lot better on mobile):

1- click link --> write new password

.. VS ..

2- copy password --> open browser --> open site --> paste password to login -> click on change password --> write new password

  • Some users will not change password after signing-in;

    • which makes them vulnerable due to having their password in plain text email
    • also they won't be able to login later because they don't remember that password
3

If you're designing for both desktop and mobile (ha! Who isn't now?) then it's a reset link is better than a temporary password. Why?

  • It's difficult to copy and paste a password on a mobile device
  • It's difficult to remember the nuances of a strong temporary password in between switching browser tabs on a mobile
  • People are unlikely to change their temporary password on a mobile device. This leads them into a vicious circle of forgetting their temporary password & resetting ad infinitum. I call this phenomena "the circle of password ignorance".
2

I find what happens when you send a temporary password, the user never goes back to change it and it's usually too difficult to remember. So what ends up happening is that the "forget password" link is pretty much used every time the user logs in. The goal really is to get them to reset their password to something that they will remember so best to be direct about it.

It's also more common (in my experience) for a password to be reset so a user may miss the temporary password in the email and cause more confusion.

1

Although I agree that a link is better than a temporary password in a plain text mail, I'd like to add that, as a user, I'm kind of afraid of those links, specially when I'm trying to recover my password by my own, by searching old e-mails of the website in my inbox. The URL is usually long, with many codes and I'm not sure if the web site will behave well if I use a URL that is not the last one generated, or not new enough, or that has already been used. It usually works fine; it's just a hesitation (this happens only to me?). Maybe this could turn into a detailed explanation somewhere in the help section of your website.

0
  • I don't know or store any password at all on my systems.
  • I don't want to know any password.
  • I do not generate any password.
  • If your site/app stores passwords, then you have a security issue.

When the user forgets his password (I do too) I follow this procedure:

  1. Ask a random security question
  2. Send an email with a link for resetting the password.
  3. Link works for a short period of time and only from the same IP address it was requested.

Why are salted hashes more secure for password storage?

-6

the form is called reset password form, not email me a temporary password form.

there's your answer right there

  • 1
    popular answer! – colmcq Jan 29 '15 at 17:09
  • 1
    both actions reset the password – Toni Leigh Jan 29 '15 at 18:07
  • You may be right, but how does this answer OP's question on sending a temp password or just sending a link? – Benny Skogberg Jan 30 '15 at 6:43
  • Because it infers, via extreme brevity, which of the options the user expects. – colmcq Jan 30 '15 at 11:19
  • @ToniLeigh both actions set up a chain of events that result in a new password, more correctly. – colmcq Jan 30 '15 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.