4 ms·
>from a UX perspective some of these rules may be best to only tell the user about if they actually trigger it. This is fine if you have reasonable password po
by thesuitonym 4y ago
>from a UX perspective some of these rules may be best to only tell the user about if they actually trigger it.
This is fine if you have reasonable password policies, but I've run up against incredibly frustrating password requirements that were hidden until I triggered them. The workflow went like this:
Password manager generates a password, attempt to submit. "Password must be less than 20 characters"
OK, regenerate a new password at 19 characters. "Password must include at least one special character."
...OK, add special characters in the list. "Password cannot contain %."
If they just told me all of the rules at the beginning, I could have made sure my password worked the first time.
- throwaway2016a 4y agoYeah, kind of a lesser of two evils sort of thing. Though immediate validation client-size would help. The best UX would be to just not have ridiculous rules like "cannot contain %" I was referring more to the "cannot be the same as last 4" policy and things like really long password lengths (too long to expect a reasonable person to type in). If your max length is, say 500, you probably don't need to include it in a long list because a reasonable person would never hit 500.