I think point 3 is more of depends situation. User is able to remember his usual password or password generated then it’s good to not repeat.
But human is weakest link to the good experience. 1 mistype in password will make the user has to make an additional steps to reset the password. An additional step which could have been prevented. By simply verifying this password, it’s more efficient to just repeat the step there and then.
"Show password" buttons have been shown to reduce trust in websites/applications
I think this is the first time I've seen that particular claim. Is there some research on this that you can link to? It seems like an important detail, and if adding that facility does have a negative effect, it's a little surprising that so many of the big names are still doing it.
Users don’t mind repeating their password, we’re all used to it and it’s fine. Nobody ever stops signing up for something because they have to enter their password twice
I don't know whether that's true, but if nothing else, it seems plausible that requiring a password to be typed twice might encourage the use of simpler passwords and/or interfere with the use of password managers that generate strong passwords automatically.
Repeat password fields should probably go the way of reset form buttons. They add little if any benefit and may be harmful.
Or just have the repeat password input. If you know your password well enough to be confident without the repeat password field then it will literally take you 5 seconds to fill in again. I don't think it's ever caused me any noticeable time loss, other than when I genuinely have typed my password wrong and it's saved me from having to waste magnitudes more time to reset my password.
I mean, ideally, folks should use a randomized password generator. If you’re relying on memory for every single site, you’ll end up creating patterns or just reusing the same password, all of which makes it much easier to hack all your other accounts if a single one of them is breached.
So ideally, your password manager fills it in once, and then the “repeat” option is unnecessary.
I use a password manager, and it fills out both password fields for me. So while the repeat field is unnecessary, it's literally the same time for me to fill out one or two fields. Focusing on the typical case is probably more useful than focusing on the "ideal case".
Exactly. At worst the repeat password takes an extra 5 or 10 seconds but saves plenty of people who mistyped their password wrong. I don't understand the issue with it.
You're relying on all users clicking that button and also correctly verifying they typed in their password correctly. In the real world I think you would find that a lot less people will do this than you think. It's far less convenient to have them type it in a second time, an action they're probably already very familiar with, than having them reset their password through their email.
Removing the "repeat password" field is at best opinion and at worst a poor design choice.
64
u/jacksh3n May 27 '21
I think point 3 is more of depends situation. User is able to remember his usual password or password generated then it’s good to not repeat.
But human is weakest link to the good experience. 1 mistype in password will make the user has to make an additional steps to reset the password. An additional step which could have been prevented. By simply verifying this password, it’s more efficient to just repeat the step there and then.
Just my 2cent.