-
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
bd6c2ac
commit bca71ce
Showing
9 changed files
with
238 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,28 @@ | ||
--- | ||
description: "" | ||
icon: Text | ||
--- | ||
|
||
### When to use Different Types of Text Fields? | ||
|
||
```mermaid | ||
graph TD | ||
A[Do users need to enter freeform text?] -->|Yes| B[Does it require a single line?] | ||
B -->|Yes| C[Use Standard Text Field `<input type="text">`] | ||
B -->|No| D[Use Textarea `<textarea>` for multi-line input] | ||
A -->|No| E[Is the input structured or formatted?] | ||
E -->|Yes| F[Use Specific Input Type] | ||
E -->|No| C[Use Standard Text Field `<input type="text">`] | ||
``` | ||
|
||
| Feature | Standard Text Field (`<input type="text">`) | Email Field (`<input type="email">`) | Password Field (`<input type="password">`) | Search Field (`<input type="search">`) | Telephone Field (`<input type="tel">`) | Number Field (`<input type="number">`) | | ||
| ------------------------------- | ------------------------------------------- | ------------------------------------ | ------------------------------------------ | -------------------------------------- | -------------------------------------- | -------------------------------------- | | ||
| **Use Case** | General text input | Email addresses | Password entry | Search queries | Phone numbers | Numeric inputs | | ||
| **Supports Auto-Validation?** | ❌ No | ✅ Yes (valid email format) | ❌ No | ❌ No | ❌ No | ✅ Yes (only numeric input allowed) | | ||
| **Supports Autofill?** | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | | ||
| **Masking Support?** | ❌ No | ❌ No | ✅ Yes (hides input characters) | ❌ No | ❌ No | ❌ No | | ||
| **Allows Non-Standard Input?** | ✅ Yes | ❌ No (only valid email formats) | ✅ Yes (hidden input) | ✅ Yes (optimized for search) | ✅ Yes (any phone number format) | ❌ No (only numbers allowed) | | ||
| **Special Keyboard on Mobile?** | ❌ No | ✅ Yes (`@` and `.com` on keyboards) | ✅ Yes (secure keyboard) | ✅ Yes (optimized for searches) | ✅ Yes (numeric keyboard) | ✅ Yes (numeric keyboard) | | ||
| **Supports Pattern Matching?** | ✅ Yes | ✅ Yes | ❌ No | ✅ Yes | ✅ Yes | ✅ Yes | | ||
| **Best For** | General-purpose text input | Emails | Secure password entry | Search bars | Phone number input | Numeric-only input | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,14 +1,143 @@ | ||
--- | ||
description: "Secure password entry with feedback" | ||
icon: Lock | ||
status: complete | ||
--- | ||
|
||
import { Callout } from "nextra/components"; | ||
|
||
# Password | ||
|
||
<Callout type="warning"> | ||
This page is empty for now. Please help us by | ||
[contributing](https://github.com/thedaviddias/ux-patterns-for-developers/blob/main/.github/CONTRIBUTING.md) | ||
to add content. | ||
</Callout> | ||
import { BrowserSupport } from "@app/_components/browser-support"; | ||
import { BuildEffort } from "@app/_components/build-effort"; | ||
|
||
## Overview | ||
|
||
A **Password Input** is a specialized text field designed to securely collect user passwords. It masks characters to prevent onlookers from reading the input and may include additional security features such as password visibility toggles, strength indicators, and validation requirements. | ||
|
||
Password fields are commonly used in **authentication forms, account creation, and security-related input fields** where sensitive data entry is required. | ||
|
||
<BuildEffort | ||
level="medium" | ||
description="Requires input masking, secure storage considerations, optional password strength validation, and accessibility features." | ||
/> | ||
|
||
## Use Cases | ||
|
||
### When to use: | ||
|
||
- **Login and authentication forms** – Securing user access to accounts. | ||
- **Account creation and password updates** – Ensuring users create strong, secure passwords. | ||
- **Two-factor authentication (2FA) or PIN entry** – Protecting access to critical information. | ||
- **Security-sensitive fields** – Protecting data such as encryption keys or private access codes. | ||
|
||
### When not to use: | ||
|
||
- **For non-sensitive text input** – Use a standard [text field](/patterns/forms/text-field) instead. | ||
- **For one-time codes (OTP) or PINs** – Use the [Code Confirmation](/patterns/forms/code-confirmation) pattern instead. | ||
- **For password confirmation fields** – Use an inline validation approach to avoid user frustration. | ||
|
||
## Benefits | ||
|
||
- **Enhances security** – Prevents passwords from being visible to onlookers. | ||
- **Reduces accidental exposure** – Masks characters by default. | ||
- **Encourages strong password usage** – Supports strength indicators and validation rules. | ||
- **Supports accessibility** – Allows users to toggle visibility when needed. | ||
|
||
## Drawbacks | ||
|
||
- **Usability concerns** – Masking can lead to mistyped passwords. | ||
- **Increased cognitive load** – Users may struggle to recall their input without visibility. | ||
- **Potential security trade-offs** – Some password visibility toggles may pose a risk if not well-implemented. | ||
|
||
## Best Practices | ||
|
||
### Content & Usability | ||
|
||
**Do's ✅** | ||
|
||
- Provide a **password visibility toggle** to allow users to verify input. | ||
- Display **clear error messages** when password criteria are not met. | ||
- Indicate **password requirements before users type** to prevent frustration. | ||
- Offer **password strength indicators** to encourage secure choices. | ||
- Allow **paste functionality** to support password managers. | ||
|
||
**Don'ts ❌** | ||
|
||
- Don’t enforce **arbitrary complexity rules** (e.g., forcing special characters unnecessarily). | ||
- Avoid disabling **autofill** unless there is a valid security reason. | ||
- Don’t store passwords in plaintext or insecurely transmit them. | ||
|
||
### Accessibility | ||
|
||
**Do's ✅** | ||
|
||
- Ensure the password toggle is **keyboard accessible**. | ||
- Use **aria-describedby** to associate password requirements with the input field. | ||
- Maintain **high contrast and clear focus states**. | ||
- Allow users to **verify their input** without compromising security. | ||
|
||
**Don'ts ❌** | ||
|
||
- Don’t rely on placeholder text for password guidance—it disappears when users type. | ||
- Avoid requiring **excessive special characters** that make passwords difficult to remember. | ||
- Don’t assume all users can see visual strength indicators—provide **text-based guidance**. | ||
|
||
### Security Considerations | ||
|
||
**Do's ✅** | ||
|
||
- Use **secure hashing algorithms** when storing passwords. | ||
- Enforce **rate-limiting and lockouts** for repeated failed attempts. | ||
- Implement **2FA options** for high-security applications. | ||
- Allow **longer passphrases** for enhanced security. | ||
|
||
**Don'ts ❌** | ||
|
||
- Don’t log passwords in any form. | ||
- Avoid showing **password hints** that expose sensitive information. | ||
- Don’t rely solely on client-side validation—perform checks on the server as well. | ||
|
||
### Layout & Positioning | ||
|
||
**Do's ✅** | ||
|
||
- Place password fields **close to their confirmation fields** if applicable. | ||
- Use **inline validation** to inform users of errors in real time. | ||
- Ensure adequate **spacing and alignment** for clarity. | ||
|
||
**Don'ts ❌** | ||
|
||
- Avoid forcing **password confirmation fields** unless absolutely necessary. | ||
- Don’t position error messages far from the field they relate to. | ||
|
||
## Testing Guidelines | ||
|
||
### Functional Testing | ||
|
||
**Should ✓** | ||
|
||
- [ ] Verify that the password field **masks input by default**. | ||
- [ ] Ensure the **password visibility toggle works correctly**. | ||
- [ ] Test **autofill and password manager compatibility**. | ||
- [ ] Validate that **password strength indicators update dynamically**. | ||
|
||
### Accessibility Testing | ||
|
||
**Should ✓** | ||
|
||
- [ ] Ensure **screen readers announce password requirements and errors clearly**. | ||
- [ ] Confirm **toggle visibility button is keyboard navigable**. | ||
- [ ] Check for **high contrast between text and background**. | ||
|
||
### Security Testing | ||
|
||
**Should ✓** | ||
|
||
- [ ] Ensure **passwords are encrypted before storage**. | ||
- [ ] Validate that **passwords are never logged or stored in plaintext**. | ||
- [ ] Test **rate-limiting and brute-force protections**. | ||
|
||
## Related Patterns | ||
|
||
- [Text Field](/patterns/forms/text-field) – Standard input for non-sensitive text. | ||
- [Two-Factor Authentication](/patterns/security/2fa) – Additional authentication layer. | ||
- [Security Best Practices](/patterns/security/best-practices) – Guidelines for secure input handling. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters