Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was wondering what the "standard" usage rate of the "forgot my password" flow is on other ecommerce/industry websites? Right now not that many people go through the "forgot my password" link on my website, but that's mainly because most people don't have passwords. I'm in the process of installing a new login (which will encourage people to create passwords), so I anticipate that the number of people who go through the "forgot my password" link will go up, but I don't have any real baseline to compare it against.

So does anybody know what the typical percentage of users executing the "forgotten password" flow is?

Users may access the site multiple times a day, or may go a month without accessing the site. A typical user will be prompted to log in once every four weeks. Our password requirements are currently minimal (one character will suffice), but we do suggest in the case of a weak password that the user make the password stronger. We're thinking about adding a four or five-character minimum requirement, but that's about it as far as strengthening the password restrictions.

share|improve this question
add comment

4 Answers

Anecdote alert

From personal experience it's the sites that I don't access very often where I forget my password and have to access the "forgot my password" flow. For sites I access frequently I can remember them.

So make sure that the pages are very friendly for the occasional user.

So from my small sample of 1 the usage rate would be inversely related to the visitation rate. Frequent users won't use the option very often where occasional users will.

I know this doesn't directly answer your question but might give you some insight into the type of user who'll use this option.

share|improve this answer
1  
funny and sadly true! –  tony roth Aug 11 '10 at 17:15
add comment

I'm down to about a 1:1 ratio of password resets to logins that aren't already saved in my browser. Get the new password, paste it in, say 'yes' to saving it, ignore until new computer. On the plus side having used this "system" for a few years now all of my random one off accounts from god-knows-how-untrustworthy sites are different randomly generated strings. Its probably overall improved my security.

share|improve this answer
add comment

This is a difficult question to address since it'll vary across demographics. You'll benefit from from many examples (I'll provide one).

My team created a large walled website that allows our account managers to set the password requirements for their particular projects and participants in projects. The site has been running for 1 year and we've found that:

  1. the more complicated the password is (set by user), the less often our users require a password reset
  2. the more complicated the password is (set by project requirement), the more often our users require a password reset
  3. the simpler a password is, the more ofter our users require a password reset
  4. if a password is set by a project manager and simple (ie turtle), the participant is still very very likely to request a password reset.

That last two I believe often occurs because someone is more likely to create a forgettable 4 character password than a memorable 8 character password. The more time you (the end user) spend thinking about your password reqs, the more likely you'll be to remember it.

You're going to have to find a balance. The real problem I believe you'll face though is that you didn't get it right the first time (by requiring password from the start) rather then adjusting your requirements over time (as you find how your users interact with them) to get it just right.

Hope you don't see an open revolt after implementing passwords!

share|improve this answer
add comment

I run a forum with about 15k active members, roughly one quarter of our daily (unique) visitors use forgotten password process but of that quarter only half actually complete the reset.

Don't ask me why, but some people seem to have their memory jogged in between requesting the reset and getting the email!

share|improve this answer
    
Do you think more users don't complete the forgotten process because they give up and then don't login, or because they remember their password and then successfully login without needing the rest of the "forgot password" process? –  user50897 Aug 16 '10 at 14:00
    
There was a discussion about this on the site a while back, we have quite a few people who are infrequent users and they seem to be the main users of the process and have said they're happy with it. Some other users don't seem to realise that they can change their passwords on their profile pages no matter how many times they are reminded. I worried about it for a long time but the process is as good as it can get and the members are happy! –  toomanyairmiles Aug 17 '10 at 20:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.