Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Hot answers tagged

285 votes
Accepted

Is there a problem with hiding "forgot password" until it's needed?

Tbh I don't really see any use for the "forgot password" button/link, unless the user put in a wrong password before. Let me try to paint a picture to explain why the comment above is a huge ...
user avatar
106 votes

Argument for/against splitting login process into checking username, then ask password?

On the second page, either display "user found" and ask for password, or "user not found" and ask for e-mail again. One compelling argument against the two step approach is that the proposed design ...
user avatar
104 votes

Should passwords expire?

A compromise is that when a user returns to the site after 6 months (or whatever period) then you might helpfully recommend that they think about changing their password - along with a link to why ...
user avatar
95 votes
Accepted

What are some compelling reasons to disallow spaces in usernames?

There are a few reasons not to allow spaces in usernames... ...most of which can be resolved with proper implementation: They need to be tested with 3rd party software. Even if your software allows ...
user avatar
  • 40.3k
75 votes
Accepted

Is it OK to autocorrect users when they have mistyped parts of their email address?

I would recommend against an auto-correct as domain name extensions are about to change drastically, to the point where an email ending with "sitename.anything" will be valid. Consider an inline ...
user avatar
  • 936
71 votes
Accepted

What's the point of deactivating Num Lock on login screens?

Some compact keyboard layouts don't have a numpad, so those keys are mapped to the right-hand side of the letter section: If NumLock is on, then a user typing the password kill, will actually type ...
user avatar
  • 1,565
65 votes
Accepted

Are people sick of logins?

Answering your question, which doesn't involve specific motivation behind it. Yes, people don't like to register on sites, people don't like giving information all the time, people don't like ...
user avatar
  • 4,166
51 votes

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

So basically you want someone who signs up for a new account and enters already existing credentials, to log in as the owner of these credentials? I wouldn't recommend this: The chance that the ...
user avatar
  • 10.3k
50 votes

Argument for/against splitting login process into checking username, then ask password?

If you want something compelling that your boss can grasp then I suggest you speak to him in the universal language known as money, dinero, ducats, dolla-dolla-bill-y'all Your current situation You: ...
user avatar
  • 5,619
46 votes

Is there a problem with hiding "forgot password" until it's needed?

It's a very bad idea to not show the link. You should always give the user the option, even if they are likely to try a few passwords first. How about an example - what if you have a password manager,...
user avatar
45 votes

Should passwords expire?

No. All you're doing is pushing the security requirement into the domain of the user when really it's your concern if the data you are protecting is serious. In this case it doesn't matter what you ...
user avatar
  • 7,828
42 votes

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

Yes, log the user in There are several ways an existing user might end up on a sign-up page: User clicks sign up by mistake User recently signed up for an account and the browser URL autocomplete ...
user avatar
  • 40.3k
40 votes
Accepted

Username or Email label for login form, assuming they're the same?

If the users use the email address to log in into your application, you shouldn't use the word "Username" at all, in any place of your application. In the registration page, they should fill out the "...
user avatar
  • 721
40 votes
Accepted

Which one should be more prominent, Login button, or Register button?

The products these days are intelligent enough to predict their visitor intent of coming on the website based on past their past behavior. For example, If I have logged out of a website, then the next ...
user avatar
  • 3,899
39 votes

How to ensure users can't sign up for multiple accounts?

If you are providing a valuable service/product there will always be people trying to "cheat" the system and get in. Providing a free trial period is an industry norm and over time users may sign up ...
user avatar
39 votes

Banned user tries to log in − show a “Banned” message or a generic “Cannot log you in”?

From a security perspective, make sure you're only showing messages if the user has provided their password, even if they're banned. I would recommend a ban notifcation (including time), when the ...
user avatar
  • 994
38 votes

Which is the better UX for a user to see their password at the login screen?

There are a number of variations of the the "unmasking eye" icon but they mostly have the same issue, below are some examples: I have done some usability testing on this specific problem ...
user avatar
  • 6,976
35 votes

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

NO. There are chances that user might have no idea about their registration status on the site. And start a fresh registration. In such a case, best solution would be to OFFER a way to login by ...
user avatar
34 votes

Are people sick of logins?

Hiding information behind logins is really bad from the usability standpoint. Imagine you are a user who googles for a certain piece of information. Workflow on website without registration-wall: ...
user avatar
  • 1,120
34 votes
Accepted

Design for incorrect login

Increase contrast. In your current version the contrast between the color you use for your error message and the background color is low. Try either a brighter error color or a lighter background ...
user avatar
31 votes
Accepted

Why do financial institutions use usernames instead of emails for login?

There are a number of reasons: It prevents someone causing someone elses account to be locked maliciously (if I know your email address and you bank with Barclays I can lock you out of your account ...
user avatar
30 votes

Login and Register in one form

I think the strongest argument against this sort of pattern is simply, "How does the user know?" How does the user know that they can register simply by attempting to log in. If they know ...
user avatar
  • 311
30 votes

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

I disagree with the other answers, and say yes, it may make sense (with a couple of caveats). There is an increasing prevalence of the combined login/sign up form pattern on some sites, where the ...
user avatar
  • 14.9k
28 votes

Reducing Password Complexity?

The most common solution I've seen to this is including Facebook and Google login, considering most users will already be logged in to either of the social sites.
user avatar
  • 10.5k
27 votes
Accepted

Google and Yahoo require you to enter your username first, then password. Why is this?

Both sites are preparing new login features. Google has made an announcement explaining the reasons behind the 2 steps login process Today, you sign in to Google on a page that includes both the ‘...
user avatar
  • 32.2k
26 votes
Accepted

What colour should Register and Login buttons be?

The color of the login button should match the primary color of your style theme. Apparently, you're using material design. If your theme, for example, uses blue (#2196F3) as a primary color, your ...
user avatar
25 votes

Should passwords expire?

The quick answer: Amazon, Google and my bank don't make me change my password every six months, or indeed ever. What do you do that requires more security* than they do? Let's hope for your users' ...
user avatar
  • 351
22 votes
Accepted

Logout after password change?

For the most trouble-free experience, you should have the user log in again right there. Many users have some sort of password manager or use their browser to manage passwords (or scribble it on a ...
user avatar
21 votes

Why do financial institutions use usernames instead of emails for login?

I can speak from the bank accounts I know in europe: You don't even need an email address to have an online banking account, as registration usually happens offline - you get Pin and everything via ...
user avatar
  • 316
21 votes
Accepted

Reset password, appropriate response if email doesn't exist?

The easiest way to implement this is to say If a matching account was found an email was sent to user@email.com to allow you to reset your password. I've seen this on a few sites lately, though at ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible