2022 Developer Survey is open! Take survey.
285 votes
Accepted

Is there a problem with hiding "forgot password" until it's needed?

Tbh I don't really see any use for the "forgot password" button/link, unless the user put in a wrong password before. Let me try to paint a picture to explain why the comment above is a huge ...
user avatar
120 votes
Accepted

Should users be allowed to use any special character they want when creating a password?

If the user can type it then it should be allowed in their password. Telling someone what they can and can't use in their password always feels wrong to the user. Passwords are currently the most ...
user avatar
  • 15.8k
106 votes

Argument for/against splitting login process into checking username, then ask password?

On the second page, either display "user found" and ask for password, or "user not found" and ask for e-mail again. One compelling argument against the two step approach is that the proposed design ...
user avatar
104 votes

Should passwords expire?

A compromise is that when a user returns to the site after 6 months (or whatever period) then you might helpfully recommend that they think about changing their password - along with a link to why ...
user avatar
95 votes
Accepted

Is it good idea to send user password upon register?

No - It is a bad idea: a. Storing password as plain text instead of hashed with an individual salt. More details here and here. b. Emailing a password, as: b.1. emails are transmitted unencrypted ...
user avatar
  • 7,283
71 votes
Accepted

What's the point of deactivating Num Lock on login screens?

Some compact keyboard layouts don't have a numpad, so those keys are mapped to the right-hand side of the letter section: If NumLock is on, then a user typing the password kill, will actually type ...
user avatar
  • 1,565
63 votes
Accepted

Why do some websites (including Google) trim whitespaces in passwords?

Good observation. In my experience this happens for a number of reasons, some intentional and some unintentional. Intentional reasons to trim whitespace: Users often cut and paste passwords (yes, ...
user avatar
  • 40.3k
51 votes
Accepted

Does a password strength indicator increase password strength?

Researchers from Carnegie Mellon University recently (2012) looked at password strength meters and its impact on password creation. The paper "How does your password measure up? The effect of strength ...
user avatar
  • 3,580
51 votes

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

So basically you want someone who signs up for a new account and enters already existing credentials, to log in as the owner of these credentials? I wouldn't recommend this: The chance that the ...
user avatar
  • 10.3k
50 votes

Argument for/against splitting login process into checking username, then ask password?

If you want something compelling that your boss can grasp then I suggest you speak to him in the universal language known as money, dinero, ducats, dolla-dolla-bill-y'all Your current situation You: ...
user avatar
  • 5,619
46 votes

Is there a problem with hiding "forgot password" until it's needed?

It's a very bad idea to not show the link. You should always give the user the option, even if they are likely to try a few passwords first. How about an example - what if you have a password manager,...
user avatar
45 votes

Should passwords expire?

No. All you're doing is pushing the security requirement into the domain of the user when really it's your concern if the data you are protecting is serious. In this case it doesn't matter what you ...
user avatar
  • 7,828
42 votes

Should password reset functionality email a temporary password or just a reset link?

It's better to send the reset link for 3 reasons: Users don't need to remember a temporary password and they don't experience copy/paste issues. Most users don't remember their password because they ...
user avatar
  • 796
42 votes

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

Yes, log the user in There are several ways an existing user might end up on a sign-up page: User clicks sign up by mistake User recently signed up for an account and the browser URL autocomplete ...
user avatar
  • 40.3k
41 votes
Accepted

What is the best practice for password field placeholders?

This article by NNGroup actually covers this exact topic. http://www.nngroup.com/articles/form-design-placeholders/ To summarize: WORST: Using a placeholder that says "Password" with no additional ...
user avatar
  • 15.1k
38 votes

Which is the better UX for a user to see their password at the login screen?

There are a number of variations of the the "unmasking eye" icon but they mostly have the same issue, below are some examples: I have done some usability testing on this specific problem ...
user avatar
  • 6,976
35 votes

Is it good idea to send user password upon register?

Passwords should not be stored in plain text anywhere including the users email inbox. What happens if his email is compromised or if he's entered the wrong email address and someone else receives the ...
user avatar
  • 1,783
35 votes

Should users be allowed to use any special character they want when creating a password?

If a site requires that passwords only contain certain character codes, then a user will be able to enter the password into almost any device which is capable of producing those characters. If the ...
user avatar
  • 3,245
35 votes

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

NO. There are chances that user might have no idea about their registration status on the site. And start a fresh registration. In such a case, best solution would be to OFFER a way to login by ...
user avatar
32 votes

Does a password strength indicator increase password strength?

Password strength indicator does not, per se, guarantee stronger passwords - from a pure UX perspective the more complex your requirements are the more likely people are to click away, to use an ...
user avatar
  • 1,098
30 votes

Does it make sense to authenticate a user when he/she provides existing valid credentials while registering?

I disagree with the other answers, and say yes, it may make sense (with a couple of caveats). There is an increasing prevalence of the combined login/sign up form pattern on some sites, where the ...
user avatar
  • 14.9k
28 votes

Reducing Password Complexity?

The most common solution I've seen to this is including Facebook and Google login, considering most users will already be logged in to either of the social sites.
user avatar
  • 10.5k
25 votes

Should passwords expire?

The quick answer: Amazon, Google and my bank don't make me change my password every six months, or indeed ever. What do you do that requires more security* than they do? Let's hope for your users' ...
user avatar
  • 351
22 votes
Accepted

Logout after password change?

For the most trouble-free experience, you should have the user log in again right there. Many users have some sort of password manager or use their browser to manage passwords (or scribble it on a ...
user avatar
20 votes

Should users be allowed to use any special character they want when creating a password?

I would like to add to DaveAlger's point. I, like many people, create algorithms in order to better remember passwords. I've spoken to many people (in an informal manner) about passwords and I have ...
user avatar
  • 6,621
18 votes

Should password reset functionality email a temporary password or just a reset link?

Usability Implications A link is much more accessible. I can get to a link via click, tap, or with the keyboard easily; and in a confined device like a smart phone the process of opening the site in ...
user avatar
  • 7,828
17 votes

Argument for/against splitting login process into checking username, then ask password?

The general rule is, every page of process drops the success rate by 50%. It's probably a little bit of an exaggeration, but people think of a page as one unit of work, almost regardless of how ...
user avatar
17 votes

Argument for/against splitting login process into checking username, then ask password?

I'm not sure if this is exactly a UX concern, but password managers (LastPass, KeePass, etc.) can be configured to automatically or semi-automatically fill in username and password fields when they ...
user avatar
  • 269
17 votes

Is it good idea to send user password upon register?

Please don't. I snagged (myfirstname)@gmail.com several years ago. There are a few other people who share my first name, and they occasionally forget that their email address is not (myfirstname)@...
user avatar
  • 3,623
14 votes
Accepted

Best practices for picture password implementation

Sorry, but I find your idea a) not really user friendly [actually rather user un-friendly] and b) additionally I would also consider your approach risky – very risky – even if you managed to solve the ...
user avatar
  • 3,220

Only top scored, non community-wiki answers of a minimum length are eligible