Users register on a website and create a login and password. It is likely that users will forget the password and/or login at some point. You should cater for password recovery so that they can log in again.
The best solution for password security is a password that is not too complex to remember. A high-security password that is written on a post-it sticking to a monitor is less secure than an easy-to-remember password. But even easy-to-remember passwords are often forgotten.
The best way of offering password recovery is by sending an e-mail containing the password. For websites with a high security level it is best to send an e-mail with a temporary password.
Dos and don’ts
First of all: do not go overboard on security. Not all websites need a high-security password, so choose the level that suits the application. A home bank application needs a much higher security level than a login for an online forum. Start by looking at the risks involved and the chance that others will go to the trouble of cracking a password, before deciding on the security level that is needed. Read more about how to merge usability and security in the best practice for usable security.
After you have established the security level, some dos and don’ts when designing password recovery systems are as follows:
When users have created or might have created an account and have forgotten their password.
A typical internet user has multiple logins and passwords and has created many accounts over the years. They easily forget which login and password set they used when and where. They also often do not know whether they have already created an account. Helping your visitors to recover their login and/or password helps to keep them on your site.