Questions tagged [password]

A secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

Filter by
Sorted by
Tagged with
149
votes
16answers
40k views

Why should we ask the password twice during registration?

It would be easier to ask for a user's password only once during registration. The problem: The user could make a mistake while typing the password once because of hiding letters. The solution: The ...
101
votes
13answers
16k views

Should passwords expire?

I have a dispute with my partner. He comes from a financial software background but I do not. He recommends that our web app should expire user's passwords after 6 months (and it has to be unique each ...
96
votes
14answers
33k views

Is a “repeat password” field necessary in a signup page? [duplicate]

Possible Duplicate: Why should we ask the password twice during registration? When designing a new and simplified signup page I got into an argument with a colleague about the necessity of the "...
75
votes
11answers
22k views

Should users be allowed to use any special character they want when creating a password?

I came across a number of login configuration settings where there is a list of allowable special characters and was wondering: Does this limitation cater for a specific security or usability need? ...
63
votes
3answers
7k views

Why do some websites (including Google) trim whitespaces in passwords?

I have just noticed that Google as well as some other sites trims the whitespaces in the password. I can successfully sign into my google account even if I add extra spaces in the end of my password. ...
57
votes
18answers
12k views

Argument for/against splitting login process into checking username, then ask password?

My boss has insisted for a while that our login process be divided into two steps on separate pages: on the first page, ask the user's e-mail address. On the second page, either display "user found" ...
54
votes
11answers
7k views

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

Someone came up with this proposed behavior recently and I haven't been able to find examples of services working the same way. I have to say I don't really like it, but can't put my finger on a ...
53
votes
10answers
5k views

What is the best way to inspire users to choose strong password?

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be guessed/...
51
votes
16answers
11k views

Computer login with password only, without username

I have an idea to simplify the login screen on things like home computers with a small number of users (say, 2-10) with passwords. Today, a typical home computer's login screen has three steps: ...
50
votes
7answers
4k views

Designing a password/authentication system usable for young children in a classroom

We are all familiar with the best password practices for websites which will be used by adults, such as storing passwords in one-way hashes, using password resets instead of emailing password, etc. ...
49
votes
8answers
12k views

Is there a problem with hiding “forgot password” until it's needed?

To be honest, I don't really see any use for the "forgot password" button/link unless the user put in a wrong password before. In my current project, we need as much space as possible and I was ...
48
votes
10answers
7k views

Is a “Never tell your password to anyone” message in chat really necessary?

In almost every chat window I open, there's this fairly obvious statement: Never tell your [password/credit card/social security/etc] to anyone. Are there some standards for chat functionality that ...
44
votes
3answers
8k views

What's the point of deactivating Num Lock on login screens? [closed]

Many login screens automatically deactivate the Num Lock key on the keyboard before the user can enter their password. This is extremely frustrating for the user as they involuntarily type their ...
40
votes
5answers
6k views

Does a password strength indicator increase password strength?

Just browsing the internet, I saw a password strength indicator on a sign up, and I realized that I personally didn't care. Does anyone know if, on average, password strength indicators increase the ...
39
votes
10answers
8k views

Is it good idea to send user password upon register?

I can imagine both ways - send / not send and still make it secure enough inside application. For instance: I get the password from "Enter your password" field, store it in email template and then ...
37
votes
8answers
17k views

Is it necessary to verify a user's email address?

It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code. Is it really necessary to do this ...
36
votes
7answers
14k views

Are there numbers and letters to avoid for activation codes via SMS?

We are at a fairly early stage in our application development and have run into a usability issue related to typing an activation code sent via SMS into a browser URL. Here's the basic scenario: You ...
32
votes
5answers
4k views

Should a user be logged in after resetting their password?

Lets assume following flow: I want to log in I don't remember password I click on the "forgot my password" link (email is dispatched) I check my inbox and click on the link I type in a new password ...
30
votes
6answers
3k views

Forcing users to use a particular pattern for passwords

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital ...
28
votes
3answers
5k views

Should I trim spaces in passwords?

The problem is that we send a user an email with a generated password if they forget. If they choose to cut and paste it in, then Outlook typically adds a " " to the end of it. When they paste it ...
28
votes
5answers
19k views

What is the best practice for password field placeholders?

It seems like the accepted best practice for email fields is to have a label and an example email address. Assuming you want a consistent style, the label will make it clear that it's a password field....
24
votes
8answers
4k views

How to handle “forgot password” when user has not confirmed email?

If you follow the pattern of allowing users access to your application without having confirmed an email (generally considered good UX), how do handle the case where they forgot their password? Very ...
23
votes
9answers
7k views

Reducing Password Complexity?

Since starting my new role I've found that 20% of log in sessions are resulting in a dropout. From watching user recordings, I believe this is down to users forgetting their password. Users log in ...
21
votes
3answers
4k views

Should password fields have an unmask checkbox?

Is it a good idea to have an unmask checkbox for user selection when the users type their password to show them what they typed?
19
votes
6answers
3k views

Why do users erase all the password when they hit one wrong key, instead of just the last wrong character?

We login to applications almost every day. The password is stored in our fingers, as an automated process (if they have used it long enough). When users realize they have entered a wrong character (...
19
votes
5answers
4k views

Should I let a user copy/paste into a confirm e-mail field for a registration form? [duplicate]

Possible Duplicate: Preventing a user from pasting from the clipboard into a mandatory form field There was a question of stackoverflow, that a programmer did not wont to let the new users just ...
17
votes
9answers
7k views

Should password reset functionality email a temporary password or just a reset link?

When a user submits a reset password form, which UX is preferred? A temporary password is created for them to use. It's emailed to them. They log in and then a permanent change password form is shown....
17
votes
2answers
1k views

Should we send both username and password after registration?

After users have registered on a website, should that website send both username and password in their registration confirmation email ?
17
votes
5answers
5k views

Pros and Cons for having same form for login, register and forgotten password

I have notice some sites have the same form for login, register and forgotten password. Below the form you have 3 buttons i forgot my password register log me in What are the pros and cons on ...
16
votes
5answers
3k views

Should I use two steps or one when users change password?

I currently have a page dedicated to changing passwords. There are 2 options: A 2 step option: download bmml source – Wireframes created with Balsamiq Mockups download bmml source A 1 step ...
15
votes
3answers
4k views

Which is the better UX for a user to see their password at the login screen?

These are the two options I'm considering. Having a tickbox for a 'show password' option, which would let the user see their password. A 'caps lock' icon would be in the password text area which ...
15
votes
2answers
5k views

Email confirmation on password reset?

I am building a prototype to a system that has a user account system in place. Of course with any account system, the user should be able to reset their password should the need arise (e.g., ...
15
votes
7answers
2k views

Password field in cleartext

I'm building a mobile web app that will request a bunch of information from the user (name, dob, address, etc) and am trying to cut down as much fields as I can. I've noticed a new trend where mobile ...
14
votes
6answers
877 views

What is the best way to request individual characters from a password?

Frequently, sites that should really value security (especially banks) ask for several individual characters from a password. Typically I've seen them do it like this: download bmml source – ...
14
votes
7answers
9k views

Should my app send a confirmation email on user registration?

I'm grappling with the user registration experience for my application. I'm considering this model: User enters... Username Password Password confirmation Email address The app displays a message ...
14
votes
4answers
913 views

Is it good UX practice to have a website generate a password for the user?

Is it good UX practice to have a site generate secure random passwords for users and send it to their email or is it better to have them enter their own one each time?
14
votes
6answers
11k views

What is the recommended time before a reset password link expires?

I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset ...
13
votes
4answers
1k views

Should password field be cleared if Captcha is wrongly entered?

On registration screen there are 3 fields: Email, Password and Captcha. User has entered valid email and password but has entered wrong Captcha. Here an error message specific to the wrong Captcha ...
13
votes
5answers
3k views

Is it appropriate to display the warning message “Caps Lock is on”?

Is it appropriate to display the warning message "Caps Lock is on" when focus shifts to Password field? In gmail and yahoo I don't see it. So, what does the standard say?
13
votes
2answers
2k views

Why not show password criteria on login screen?

I have frequently bumped into this issue: sites ask for my password (e.g. Stack Exchange itself) when I want to do something like updating my profile. This is per se a low priority site for me so I ...
12
votes
5answers
4k views

Is only having a single unmasked password field (no confirm) on a registration page a bad idea? [duplicate]

Some sites allow you to register and only provide a single password box, which is protected with stars. Traditionally a "confirm password" box is used when registering which allows you to confirm ...
12
votes
4answers
2k views

Should we disallow common passwords like “password” and “12345”?

Studies show that people can use some really "insecure" passwords. Here's Mashables worst 25 passwords of 2011 for example. To protect security on our sites (and the overall experience of less-hacked ...
12
votes
4answers
4k views

Social Login adoption vs Traditional Login

I have implemented janrain's social login on my website. I am wondering how important it is to include a traditional login (email/password) system. I believe there may be a significant percentage of ...
12
votes
4answers
2k views

Allowing every password of 6+ characters. Good practice?

I am developing a file sharing and hosting service, and right now I don't have any requirements set other then that a password has to be at least 6 characters long. I also accept all characters. I'm ...
12
votes
6answers
4k views

Why do sites split 'password' and 'username' retrieval into two separate operations?

I find this way of doing it highly annoying when I come back to a site I haven't used in a while. First having to enter my email to get my username and then enter my username and email to reset my ...
12
votes
3answers
2k views

Should password fields be blanked when inline validation fails?

This question with a similar name refers to registration, but in my case, I would like to address submission. My use cases are: A login form consisting of an email address. A change password form ...
11
votes
9answers
592 views

barebone registration: is password repitition and captcha really essential?

If you design a barebone registration form which only requires email address and password as essentials can you omit the password repetition and captcha without too much technical trouble? I ...
11
votes
10answers
3k views

What is an easier unlock pattern: gesture or code?

There are two popular ways to unlock a phone. iPhone makes you type in a numerical code. Android gives you the option to draw a gesture. Which of these two is easier to remember and easier to execute? ...
11
votes
2answers
3k views

“Forgot password?” or “Reset password”?

We're designing a minimalist login page that follows Google's Material design guidelines. Near the password field, there is an icon with a link to the Reset password page. For such link, what name is ...
11
votes
2answers
2k views

Why do most Create Account forms clear the password fields upon wrong validation? [duplicate]

In most Create Account forms that I've used, when you enter in something wrong (username not long enough, passwords don't match, invalid email, etc.), it'll keep all the fields but erase the password ...

1 2 3 4 5