Let's say my password field has the following validations (not limited to) on my Sign Up form,

  • Password length should be 6-12 characters.
  • Password must contain at least 1 number.
  • Password must contain at least 1 symbol.

And on the application, whenever the focus is on the password field, a tooltip will inform the user of these conditions.

If one of these conditions are not satisfied, it makes sense to display what they did wrong in the message.

Ex: If the password contains a number and a symbol but is not between 6-12 characters, it should display the message:

The password should be between 6-12 characters.

But what if all 3 or 2 conditions are not satisfied. Should I display all 3 messages or is it ok to just say "Invalid password" whatever the case might be since the conditions are shown on the tooltip when the focus is set to the password field.

Will the user feel lost or will they recall tapping the password field again to read the rules?

This is a mobile app. So space is a concern.

2 Answers 2


If the user encounters this message, it is very likely they are unaware of what they did wrong. So just getting "Invalid password" is a recipe for a bad user experience.

Although slightly inelegant from a programming perspective, you should probably make one custom error message for each of the seven different error cases. That way you can make each message concise. You already have 3 error messages, so add 4 more.

Also @Splatz's suggestion of adding a green tick for when the password is good is a very user friendly way of doing it.


I do not recommend hiding your password requirements under a tooltip which requires focus.

The best solution I have ever seen for multiple password requirements, listed all the password requirements up-front on the page, together with a message that states all the password requirements need to be met. As the user types out their password, when they met a requirement, that requirement was given a green tick . In this way the user is getting real time visual feedback as they type. If they still decided to submit without meeting one or more of the requirements, an error message would display informing them that all the password requirements need to be met.

I have seen another system where the user is just given a password strength rating as they type (poor, good, better, strong, etc.), but obviously this system did not enforce password strength rules - it only told you if it was good or not.

I guess it all depends on how strict you business needs are when it comes to passwords.

NNGroup have good examples to illustrate both of these techniques: https://www.nngroup.com/articles/password-creation/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.