Questions tagged [password]

A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

Filter by
Sorted by
Tagged with
0 votes
1 answer
40 views

Why don't Wifi router UI's use confirmation password boxes?

Consider the scenario of trying to update the Wifi password for a router. Pulling up two sources I have access to, both OpenWRT and Google's Home/Wifi app only have a single input box for changing the ...
2 votes
1 answer
33 views

How to build an events application with private events sharing?

I am building a sport application where people of a city can organize football matches and join other matches as simple users. We have currently built the basics of the application: users can create ...
37 votes
9 answers
19k views

Is it necessary to verify a user's email address?

It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code. Is it really necessary to do this ...
2 votes
1 answer
60 views

Should inline form validation error messages be specific or unspecific on login screens?

I had designed a message reading "Incorrect password" appearing on the 'Password' input field, however, a PM has given me feedback that saying: "I believe the common practice for ...
0 votes
1 answer
58 views

Show/Hide Password

Is it possible to have a show/hide password function in a disabled input field? I want the user to be able to see their password so that they don't have to reset the password in their Account Overview ...
41 votes
6 answers
6k views

Should a user be logged in after resetting their password?

Lets assume following flow: I want to log in I don't remember password I click on the "forgot my password" link (email is dispatched) I check my inbox and click on the link I type in a new password ...
62 votes
21 answers
14k views

Argument for/against splitting login process into checking username, then ask password?

My boss has insisted for a while that our login process be divided into two steps on separate pages: on the first page, ask the user's e-mail address. On the second page, either display "user found" ...
1 vote
1 answer
64 views

Changing the user's email address

We have a dashboard that our users log into using their email and password. We don't currently have the ability to allow them to change their own email address (login). Sometimes, a user may contact ...
8 votes
4 answers
6k views

How many incorrect attempts should be allowed before invalidating a password?

I am trying to prevent brute force attacks on a user's account by invalidating a password when too many attempts are made in the same minute, hour, day or something similar. The credentials in this ...
0 votes
2 answers
121 views

Is there a reason to ask for password only after typing login? [duplicate]

I saw that there is a recent trend in splitting the sign-in step into two: login followed by password (rather than in a single stage). That is, the flow is: [type username] -> [confirm] -> [type ...
2 votes
1 answer
259 views

Are password strength meters useful?

What are your thoughts on password meters? I think they are only somewhat helpful because there is no clear indication as to how to actually strengthen the password. A novice user could maybe type in ...
1 vote
1 answer
83 views

Should i use a single or double page to edit a password?

I was wondering about changing a password in an application. Is it more correct to ask as usual, all three (old, new and confirm) passwords on the same page or is it better to ask for the old password ...
25 votes
9 answers
6k views

How to handle "forgot password" when user has not confirmed email?

If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very ...
0 votes
2 answers
299 views

How to properly represent "leave unchanged"

Users can edit various information, it's all in the same modal (including the password). What would be the best way to represent to the user "leave blank to remain unchanged" (referring to passwords)....
1 vote
0 answers
101 views

What are usability implications of using magic link/password-less only login for older users?

The audience of the product tends to be older (50+) so it is very likely that it would be their first time using an app that is password-less login only. We fear this might be confusing for this user ...
4 votes
1 answer
1k views

Why are OTP password fields masked?

If purpose of an OTP (One Time Password) is temporary usage, then what purpose is served by keeping OTP fields masked? Even if anyone can view that password while user is typing it, IMO there is no ...
7 votes
3 answers
2k views

Expected behaviour when clicking to reset a password multiple times?

When a user uses the »I forgot my password« link several times and gets a couple of emails, each one with a tokenized link to reset his password, what would be the appropriate behaviour? All links ...
6 votes
5 answers
1k views

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

I work at a healthcare tech start up which is pretty strict about its login guidelines, largely because protecting patient and provider info is such a vital need in this industry. But while our ...
3 votes
2 answers
116 views

How to solve the "Set a password"-step problem in a really user-friendly way?

I'm an advocate of lesser cognitive load process, moreover when this process includes lots of forms and steps. I think we all are at some point. The password step by itself if usually full of pain ...
5 votes
2 answers
2k views

How is a two-step login better than single-step when you have a password manager?

I am using a browser-based password manager. For most websites the login workflow is: Go to login page. Both username and password field are visible. Credentials are auto-filled by password manager. ...
1 vote
1 answer
79 views

Is there any advantage to bringing the user in-app for reset password vs in a browser?

Is there any notable difference between bringing the user to a browser to 'reset password' vs bringing them back to the app to do the reset? Considering that this platform exists as an app and as a ...
1 vote
4 answers
77 views

creating the correct password parameters for a site, with cc details stored

I am trying to think of the best requirements to set a password for a customer relationship management cloud software service. A credit card is stored on the site, which is only useful to the site ...
1 vote
2 answers
66 views

Where would you look for your password settings?

Organizing app info. Where would you expect to find your password settings - under settings or under profile?
18 votes
4 answers
7k views

Which is the better UX for a user to see their password at the login screen?

These are the two options I'm considering. Having a tickbox for a 'show password' option, which would let the user see their password. A 'caps lock' icon would be in the password text area which ...
18 votes
5 answers
6k views

Pros and Cons for having same form for login, register and forgotten password

I have notice some sites have the same form for login, register and forgotten password. Below the form you have 3 buttons i forgot my password register log me in What are the pros and cons on ...
2 votes
1 answer
1k views

Best practices for “show password” functionality

In a mobile app context, when the user is presented with a dialog specifically asking for a password, what are the best practices for allowing the user to show the password while entering it into the ...
8 votes
3 answers
1k views

Perceived security of magic link/passwordless login

As far as I've read, passwordless login like Slack uses (user inputs their email and then clicks on the login link in their email) is becoming more common and is just as secure as logins that require ...
2 votes
3 answers
2k views

How to prompt existing customers to change their passwords

I'm looking for some UX examples of how other companies have handled this situation: Scenario: Devs are using an old password encrypting method (sha1) I believe and need to change it to a more secure ...
50 votes
8 answers
13k views

Is there a problem with hiding "forgot password" until it's needed?

To be honest, I don't really see any use for the "forgot password" button/link unless the user put in a wrong password before. In my current project, we need as much space as possible and I was ...
5 votes
4 answers
322 views

Passwordless flow: What to do when user enters an invalid email when logging in

I'm planning to make my app passwordless and I've seen sites implement things differently when one puts in an email they haven't actually used for an account on the site before when trying to login. ...
0 votes
3 answers
173 views

Is it lazy or inconvenient not to distinguish between password reset use cases in the UI?

I was recently asked to reset a password due to the fact that the security requirements for the website had been upgraded, and the users have been asked to change their passwords (for those that don't ...
8 votes
5 answers
390 views

Forcing Users To think up More Complex Passwords / Ease of Remembering Them

Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have ...
4 votes
1 answer
149 views

Browsers ruin password UX with dropdown menus. How can I fix it?

FYI the image above was taken with autocomplete="new-password" As you can see, the dropdown is covering the error message (which ends in "letters and numbers" (plus a few other error messages). This ...
2 votes
2 answers
2k views

Changing password: Verify with old password, verify by email, or don't verify?

Scenario I want to change my password. I have access to my account, this is not a forgotten password journey. I've seen three approaches to this. Method 1: Re-verify with old password Log on ...
13 votes
3 answers
3k views

Should password fields be blanked when inline validation fails?

This question with a similar name refers to registration, but in my case, I would like to address submission. My use cases are: A login form consisting of an email address. A change password form ...
14 votes
7 answers
10k views

Should my app send a confirmation email on user registration?

I'm grappling with the user registration experience for my application. I'm considering this model: User enters... Username Password Password confirmation Email address The app displays a message ...
6 votes
7 answers
5k views

Forgotten passwords - should the temporary password expire?

Just designing the forgotten password form for a retailer. When researching other retailers, I've have noticed the temporary password link that gets sent to inbox's expire after a few hours. What is ...
16 votes
6 answers
23k views

What is the recommended time before a reset password link expires?

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset ...
9 votes
1 answer
36k views

Telling users passwords don't match and aren't strong enough

I have two functions in my user registration form One checks the password and confirmed password are the same. The other checks if the password is strong enough. I have two presentation related ...
155 votes
16 answers
47k views

Why should we ask the password twice during registration?

It would be easier to ask for a user's password only once during registration. The problem: The user could make a mistake while typing the password once because of hiding letters. The solution: The ...
4 votes
1 answer
240 views

Repeated password entry despite it being visible?

If the signup for a new user account dialog includes an input field to set a custom password which has an option (eye icon) to uncover its current textual contents, should there also be an input field ...
3 votes
4 answers
396 views

Ask users to set a password or pin during the registration process

We are going to give our users the ability to set a password on their apps to protect their personal data such as their transactions, wallet balance and etc. We decided to ask them to set a password, ...
3 votes
5 answers
2k views

Potential UX issues with password-less logins?

There is a fantastic article entitled Is it time for password-less login? that suggests that we could use the "reset password" link as the default login action to any site. It provides a lot of ...
2 votes
2 answers
779 views

Studies on Password Double Entry per registration

Are there any recent usability / UX and conversion studies how double entry of passwords while registration a user account in ecommerce shops slows down conversion rate? We try to ged rid of entering ...
2 votes
4 answers
609 views

Is it ever useful to show the Password Requirements on page load?

I have a hypothesis that I have no idea how to test other than lots of observational testing, but perhaps someone has covered this already. On signing up to a new service and being presented with the ...
2 votes
3 answers
3k views

Confirm password registration prompt in mobile application

Is it a good practice to prompt user to fill field 'Confirm password' on registration screen in mobile application? Could you tell pros/cons? Thanks!
3 votes
3 answers
172 views

Should you show current state or the state it's about to change to for password visibility? [duplicate]

I'm exploring the idea of adding a hide/show icons for password visibility. I understand we can just use the words "hide" and "show", but if we were to use icons, should its current state be shown ...
44 votes
3 answers
9k views

What's the point of deactivating Num Lock on login screens? [closed]

Many login screens automatically deactivate the Num Lock key on the keyboard before the user can enter their password. This is extremely frustrating for the user as they involuntarily type their ...
0 votes
3 answers
590 views

How to encourage the user to check details before submission

I'm upgrading a legacy financial application which requires users to re-enter their password before a transaction is submitted. I need to remove the password check since I'm migrating users to a new ...
2 votes
1 answer
145 views

Should this registration form include field for password now or after user passes review?

The scenario I have may be a type of edge case because of the nature of the site I'm working on. This site (note: the site is not e-commerce, it is not about generating revenue; essentially, non-...

1
2 3 4 5