For most users, the process of creating a password hasn’t changed for two decades. Typically, a person can remember up to 50 random combinations of characters, which in turn, results in choosing passwords easiest to remember. But even those are often jotted down on sticky notes neatly pinned to the monitor—remembering passwords is just as cumbersome as it was back in 1995. (I skip using services like LastPass.)

Let’s use all that information to make a few simple rules that will significantly improve the user experience.

Show Your Users the Password Requirements

TLDR: By showing the password requirements, you’re increasing the percentage of completed registrations. You’re also decreasing user frustration caused by invalid password messages.

Imagine you want to buy a new chair in an online store you aren’t familiar with. During the checkout, you’re asked to register your account (I skip the complete lack of reasoning behind forcing the user to set up an account at this point, but it’s a story for a different article), so you type in your standard password, say “polcode,” and the next thing you know, there’s the all too familiar error message: Password must contain at least one uppercase letter.

So you try one more time.

Well, good luck. Let the trials begin.

1. Password: Polcode
2. Error: Passwords must contain at least one number.
3. Password: Polcode1
4. Error: Password must contain at least one special character.
5. Password: Polcode1%!
6. Error: Password cannot contain: spaces, %, :, and +
7. Password: Polcode123!!!
8. Error: Password cannot contain a string of identical special characters.
9. Password: Polcode123!
10. Error: Password must be at least 11 characters long.

By that point (assuming you’ve survived that long), you close the store’s tab and buy the chair in a different store.

Don’t worry, we’ve all been in the same throes of frustration.

By not showing the password requirements from the very start of the registration process, you’re forcing the user to play a game without knowing the rules.

Remember, if the user is interested enough in your service or product to click “Sign up” button, you have to make this process as easy as possible.

The Solution

Make sure the password requirements are visible throughout the whole registration process. Adding an icon or a hover with the rules is not enough—the user might just as well not notice them.

By eliminating restrictions, you’re increasing successful password creation.

Don’t Hide the Password

TLDR: Let your users look up their password.

The password requirements urge the user to come up with a password fast and add more and more characters just to meet the criteria. Upon entering, the password is immediately masked by bullets.

You then force the user to use short-term memory to retype the obliterated password in the “Confirm password” field, increasing the user’s cognitive load (the level of mental effort connected with cognitive thought process).

With the password hiding behind bullets, the user cannot check for any mistakes, and often has to delete the whole password and type it again.

Studies show that this problem is most frequently encountered on mobile devices, such as cell phones or tablets.

Imagine you want to buy a new chair in an online store you aren’t familiar with. During the checkout, you’re asked to register your account (I skip the complete lack of reasoning behind forcing the user to set up an account at this point, but it’s a story for a different article), so you type in your standard password, say “polcode,” and the next thing you know, there’s the all too familiar error message: Password must contain at least one uppercase letter.

The Solution

Let your users look up their passwords as they create them. It will support their short-term memory and allow them to check the correctness of the typed password.

Don’t Require Password Confirmation

TLDR: Password confirmation is not necessary, and it can have a negative impact on the registration process.

The prevailing need for the password confirmation results from masking the password without the option of looking it up. Re-entering the password is meant to catch all typos and inform the user about errors. Does that make any sense?

In a study on signup page, the password confirmation field caused a 25% drop in the signup process. After the field was removed and replaced with a feature allowing users to look up the password, the results were astonishing.

• 14,3% more users visited the form right after entering the main page
• 56,3% increase in conversion
• 35,5% increase in registration completion
• 23,9% drop in password errors

Wrapping Up

When asking users to register, keep the process clear and transparent. Don’t make your visitors flee in terror during this crucial part of making a sale. In our next articles, we’ll show you what to do to improve your UX and give your customers the buying experience they’ll be eager to repeat again and again.