Designing password entry to provide hints

Question

Should it be way that the interaction is designed for password field in any web form or login page? Can it be the right way to showing total number of character of a password while user enters it?

Just a thought! for example

Showing first and last character (a**********g) Total number of characters (*******8*******) obviously the option of showing and hiding the character is available on existing interfaces (******show******)

While creating any account, a user can be asked to support his password with a imagery so that when s(he) forgets the password he may request to see the imagery and recall password.

This question came into my mind because i observed users do mistakes while typing passwords, user's pain of forgetting passwords frequently and following hectic password recovery process.

Answer 1

Although following your suggestion of providing password information when entering a password may make it easier to get the right password (although this is still arguable), it comes at the cost of worse security.

If someone needs an easier to remember password, let them choose that, but by you revealing something about their password when entering, you essentially force them to use an even more secure password, which is even harder to remember.

An aspect of UX is keeping private information private, and simply giving any information about a password, makes it less secure and, in my opinion, hurts the UX far more than it helps.

TL;DR: Don't do this.

Answer 2

Well then.

This probably wouldn't be a great idea.

It would be easier to hack

If you did this at the start/middle/end of the word, it would take barely any time to brute-force the account. Basically, that means that the hacker could systematically use dictionary words until they found the correct one.

It's hard to implement

Also, your login form should be focused and simple and neat, and shouldn't have all sorts of weird features like this.

Users probably won't like it

Users are used to forgetting passwords, and they might be a bit confused/shocked/angry/scared if, on the forgot password page, it said the first letters of their password in large letters.

Users are also used to getting reset emails and immediately going to their inbox after pressing the reset button. If they were just faced with two letters and still couldn't know what it was, then they wouldn't be able to get in.

Example

Let's look at this from a user's point of view.

1. You setup an account
2. You want it to be very secure (of course)
3. You've forgotten your password
4. You can't remember it at all
5. You do a password reset
6. It then shows you the first and last letter of your password in large pink and purple letters
7. You can remember your password now! Hurrah!

Now, let's look at this from a hacker's point of view.

1. You find out about this website
2. You see that the password reset shows you the first and last letter of your password in large pink and purple letters
3. You then put the user's account username into the password reset
4. Then, the letters are revealed
5. You then get a robot to try out all the dictionary words starting with those letters
6. You have then got access to the user's login details.

Now then, this would not be good. No it wouldn't.