285 votes
Accepted

Is there a problem with hiding "forgot password" until it's needed?

Tbh I don't really see any use for the "forgot password" button/link, unless the user put in a wrong password before. Let me try to paint a picture to explain why the comment above is a huge ...
Shreyas Tripathy's user avatar
71 votes
Accepted

What's the point of deactivating Num Lock on login screens?

Some compact keyboard layouts don't have a numpad, so those keys are mapped to the right-hand side of the letter section: If NumLock is on, then a user typing the password kill, will actually type ...
ralien's user avatar
  • 1,600
53 votes
Accepted

Is password-unmasking worth the potential security downside?

This is current recommended best practice by NIST The people who dinged your product for security issues are not up-to-date with current standards. In 2020 NIST published updated password guidelines ...
thegreatemu's user avatar
46 votes

Is there a problem with hiding "forgot password" until it's needed?

It's a very bad idea to not show the link. You should always give the user the option, even if they are likely to try a few passwords first. How about an example - what if you have a password manager,...
user2397282's user avatar
27 votes

Reducing Password Complexity?

The most common solution I've seen to this is including Facebook and Google login, considering most users will already be logged in to either of the social sites.
Blue Ocean's user avatar
  • 10.7k
18 votes

Is password-unmasking worth the potential security downside?

I'm a little surprised the pattern is so alien to you, and have to agree with the others on your team on this (sorry). Providing a visibility toggle for the password is a fairly common pattern across ...
Ro Achterberg's user avatar
14 votes
Accepted

Should password field be cleared if Captcha is wrongly entered?

If you clear the password field when you have a faulty password, then it should clear the password field on a faulty CAPTCHA too and it should not specifically state that it was the CAPTCHA that was ...
MichaelK's user avatar
  • 866
12 votes
Accepted

Reducing Password Complexity?

Average person has 19 passwords More than 1 in 3 (35%) of those questioned said they struggle to remember strong passwords, which is unsurprising given that the average Briton now has 19 of them to ...
Dimitra Miha's user avatar
  • 3,739
12 votes

Is there a problem with hiding "forgot password" until it's needed?

Globally Consistent Convention Versus Design "Wants" There is always weight towards convention in user experience/interface design for numerous reasons, but crucial systems where there is a safety/...
taswyn's user avatar
  • 3,087
11 votes
Accepted

"Forgot password?" or "Reset password"?

Depends: When user is not logged in, on login page, it should be Forgot password. Since the user is probably not able to login since it forgot/lost the password. Also, there are non technical users ...
Aleksandar Hocevar's user avatar
10 votes

Should password field be cleared if Captcha is wrongly entered?

No, please don't First of all, I'd try to study and test if I need a captcha. And I mean, test it thoroughly. While Captcha are an obvious enhance in security, they have severe issues in terms of ...
Devin's user avatar
  • 38k
10 votes

Reducing Password Complexity?

The very famous xkcd comics about password strengh come to mind. What you really want is not a mix of lowercase, uppercase, number, and special character. You want a password with a lot of entropy ...
Pierre.Sassoulas's user avatar
9 votes

What's the point of deactivating Num Lock on login screens?

It's a bad UX practice primarily because the user is not expecting this to happen. Users will attempt to do an action and will not be able to do so.
Juan Jesús Millo's user avatar
9 votes

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

Switch to two-factor authentication and reduce the frequency of forced password changes. BTW, your system storing their last 12 passwords, even encrypted, is a major security problem. A hacker who ...
Izquierdo's user avatar
  • 12.7k
8 votes
Accepted

Force log out users on applying a password policy?

A good password system relies on hashing (1-way encryption) and so cannot check to see if existing passwords comply with rules about criteria (video here:https://youtu.be/yoMOAIzBSpY and here: https://...
Roux Martin's user avatar
  • 14.2k
8 votes
Accepted

How to prompt existing customers to change their passwords

Ignoring the issue of lying to your customers, whether blatantly or through omission, you could simply say something like Due to recent changes, on our server we require all passwords to be ...
DrogoNevets's user avatar
7 votes

Is it a good idea to expire passwords after a time relative to their complexity?

NO This would be a security risk. You would be storing information about which passwords are less secure. The fact you had implemented this system would be easily discovered. If hackers acquired your ...
Tim Grant's user avatar
  • 3,941
7 votes

What is the recommended time before a reset password link expires?

The closest thing to a standard that I found is the OWASP Forgot Password Cheat Sheet, which says: no more than 20 minutes or so
Maxim Y's user avatar
  • 71
7 votes
Accepted

How is a two-step login better than single-step when you have a password manager?

The current state is far from ideal, but it is the best solution for the đŸ‘‡problem. The fact that some password managers are having a hard time working with it is another problem :) This usually ...
rojcyk's user avatar
  • 1,070
7 votes

Users aren't allowed to reuse old passwords for security reasons. How to alleviate this pain point?

The NIST has a policy for passwords that can be helpful to answer your question. First you should talk again to your security team. The NIST has deleted their policy to force users change their ...
Torben's user avatar
  • 71
7 votes
Accepted

Are password strength meters useful?

If the purpose of the meter is to help communicate the strength of the password, then the criteria should absolutely be shown. A meter by itself isn't enough to communicate "this is both long and ...
Izquierdo's user avatar
  • 12.7k
6 votes

Forgot Password Inline vs. Separate Page

The problem here is NOT two forms at one interface, it is the transition. The new form appears in less time than a blink. Here I've come up with nice solution: http://codepen.io/jivanshr/pen/JhoHp
Jivan's user avatar
  • 3,708
6 votes

Improving on the abcdef password

Okay, regardless of whether you're just talking to someone about it (because they've had a whinge about passwords etc) or you're trying to present a better user interface on a website or some app, I ...
Monomeeth's user avatar
  • 3,826
6 votes
Accepted

Should I create a password pattern or shouldn't I?

It's not necessarily true that your password pattern is more secure. Difficulty in brute forcing the password increases exponentially with each character, not as much with strange password ...
J. Dimeo's user avatar
  • 3,858
6 votes
Accepted

How do you set up username/password for another user without sending user a temporary password in email?

Generally the system will generate a time-based token for activation purpose and send it to the user which will lead to a password creation page to complete the registration process. Below shows the ...
Zephyr's user avatar
  • 187
6 votes
Accepted

Should keyboard suggestion bar be enabled when typing password?

It’s a bad practice for security reasons: If a user types in the password, a bystander could take a quick look. It’s way easier to read a suggestion than to follow the keys the user enters. While the ...
unor's user avatar
  • 3,956
5 votes

What is the recommended time before a reset password link expires?

There doesn't appear to be a standard. https://postmarkapp.com/guides/password-reset-email-best-practices has a password email reset guide that includes this information: Expiration information ...
Joshua Dance's user avatar
5 votes

Is it necessary to verify a user's email address?

I dont think that confirming the email address is just about having a communication channel to the user. I think that confirming emails is an absolute must, if not you have to cleanup in order to ...
Qiong Wu's user avatar
  • 151
5 votes

Argument for/against splitting login process into checking username, then ask password?

Google split the sign-in procedure in two pages and that resulted in many negative user responses: http://www.ghacks.net/2015/05/15/google-splits-sign-in-process-into-two-pages/ User complaints ...
bancer's user avatar
  • 151
5 votes

Lets the user set the password itself or send them one via mail after registration?

I think the third option is the best way to handle it if you want to split the process into two steps. You can display a message after the first step to notify the user he needs to update soon the ...
Madalina Taina's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible