Scenario: There is 300 users that buy our product on a Kickstarter campaign two months ago. We need to create these users account on our database and notify them.

We have thought two ways to accomplish this:

a) Send a email to each user with a link for creating a new password. It means that users will have an additional step to perform a login on our service.


b) Send a email with a auto generated random password to login and, if they want, change it on a future. Less steps but we see a problem here: auto generated password is not a friendly password (ie: lmd932ca) but our service remember the password forever so the users don't need to remember it.

Which is better? a) or b)? What do you think?


Edit: the core application, meaning where users sign-in/up is a mobile application

  • One question: Is this a one-time use password used as a form of two-step verification, or is it a password that they will use multiple times to sign in (eg on the app and on the website). (By two-step verification, I mean when you install WhatsApp on your phone, they send you an SMS message with a code to enter into the app to verify that you are who you say you are.)
    – user69458
    Commented Oct 21, 2015 at 17:53

5 Answers 5


A is better because of following reasons :

1.As a user i can create my own password which i can remember(most of the users keep common passwords for various apps,portals etc one password easy to remember) and can readily insert as many times as i want while using that app.

B is not a good solution because :

1.Custom generated passwords are not easy to remember each and every time i have to copy them from somewhere to insert.

  1. At some point of time i am going to change my password from custom generated to personal.Then why not do it at first step only.
  • Good reasons :) But the users doesn't enter password continuously because the app remember it until the user sign out. Commented Oct 21, 2015 at 13:11

The option a) is better since by any means the random generated password will be changed by the user.

  • Does the same not apply to option a)? Because the user will have to generate a password for that option too.
    – JonW
    Commented Oct 21, 2015 at 8:24

a) is the easier one. Providing a link to a page where I can set up a password is 1. learned behavior, 2. easy accessible, since the user can pick her own password easily and 3. users can immediately be redirected to the page you want them to be.

b) is out of question for me, since the friction you will generate with a random character password is way bigger than "Just choosing my own one".

  • Interesting... one thing that I forgot: the core app is a mobile application, not a web ;) .Thanks! Commented Oct 21, 2015 at 8:09
  • 1
    Then I would try to also use only one password input with a "show password" option (so not two password inputs). Second I would provide inline validation, so users do not have to write the password 10 times, if they did not get the restrictions right.
    – Jan
    Commented Oct 21, 2015 at 8:14

Don't make them think. From what I gathered, this is not a "toothbrush" application that requires users log in or check it up twice a day, so Option b.

As a generic user, I'd rather use a prepared for me randomly generated password and get into the system of no vital importance in two clicks than bother with creating an account (too many actions and decisions for such a minor need).

This being said, if you are targeting developers, use Option a, as they tend to prefer to hold personal control even over minute things.

  • 1
    "This being said, if you are targeting developers, use Option a, as they tend to prefer to hold personal control even over minute things" nice point :D Commented Oct 21, 2015 at 8:56

Security here should be decisive rather than usability.

Option a) is to be preferred, because option b) will result in many users not bothering to change their password and thus having their password stored in plain text in their email.

Requiring users to enter a password is a relatively minor step and is perfectly normal and acceptable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.