IMO: No, do not ask them to confirm the password if they've already confirmed their email (which they can use to reset their password if they mistype it). If th

IMO: No, do not ask them to confirm the password if they've already confirmed their email (which they can use to reset their password if they mistype it). If they haven't yet confirmed their email, then sure, ask them to confirm the password. But they could still make a mistake (e.g. if they copied from the wrong field in their password manager and then pasted it twice). It does highlight an interesting race condition of sorts. There are two times when a user can set/change their password: (1) at signup (set it), and (2) after sign up (change it). After signup, you can simply require them to confirm their email before they change their password. But what if they mistype their password during signup, then logout from their first session before confirming their email? Will their account be stranded? If they haven't confirmed their email then you probably don't want to send a password reset request to it, right? (Or maybe you do?) Arguably, it might make sense to allow sending password resets to unconfirmed emails. Because either the user set that email at signup, and thus there was no data for an attacker to steal, or they set it from within an authenticated session where they had already proved their identity. And then once you send the password reset email, you could even treat the successful reset as verification that they own the email.