Passwords, their testing and usage

Before, the «password» word was used to define a different kind of protection, for example, for entering the city and moving around it safely. In our time passwords protect physical information (documents in safes, money in banks, things in luggage), digital information on a hard drive, devices and most commonly on websites.

Password is a conventional word or a set of characters, designed for confirmation of identity or authority. Passwords are used on websites for information protection from unauthorized access.

At the moment there is no single format for password creation, therefore every internet resource that requires authorization has its own requirements for the password. Some sites do not put limits even on the minimal number of characters, and others, on the contrary, require too many. Often among the password requirements, you can find simultaneous use of lowercase, capital letters, special characters, numeric values, etc. Undoubtedly, such passwords will provide excellent protection not only from hackers but from the users themselves. More likely they will forget the combination in a few hours. There are special programmes and browser extensions (usually built-in) that can automatically generate strong passwords and store them in encrypted form. For those people who prefer to rely on their memory, there are many recommendations on the Internet for memorizing complex combinations - from rhymes to visualization.

Ideally, there should be no restrictions on the types of characters entered in the password field. And in this case, the tip about how complex a password is created will come in handy. Allowing all values from the keyboard to be entered, from letters and numbers to special characters and spaces will complicate the work of hackers to crack a password and hack an account.  Unfortunately, not all users have a responsible attitude towards their data protection and do not use the opportunities provided by developers.

There is a list of the most popular passwords that are not suitable for personal account protection and other data, but they are still the most popular. Here is a rough TOP 10 list of these passwords:

This list confirms one more time that the worst passwords are a simple set of numbers and short common words. In comparison to them, even the " qwerty12345678» combination serves as a reliable protection. It is important to create complex passwords with letters in a different case and a couple of other characters to prevent becoming the victim of hackers. For those who find it difficult to create such passwords, there are special generators in the form of separate websites and browser functions. For example, Google Chrome can offer options for reliable passwords on the registration page with the help of the "key" icon in the password field. Here is just except for the help of the saving password function in the browser, it is almost impossible to remember them for the ordinary user. However, on the Internet, you can find many recommendations for memorizing password tricks (rhymes, visualization etc) so we will not consider this topic in this article.

Now when you have an idea about the essence of a password and the most often problems connected to it, let us see what you can test in the field for entering it. Besides the compliance with GUI standards checks such as form, location and appearance of the field, you should distinguish the following testing recommendations:

1. Validation rules.

Before testing starts you must check the validation rules that were described in the requirements specification. Some products have their own rules for the valid password, therefore you should not report the bug when a password with 6 numbers is not accepted if it contradicts the customer's requirements.

2. Required fields.

You need to ensure that the «Password» and «Confirm the password» fields are required and have to be filled with identical values. 

3. Hiding characters.

If the enable/disable button is located in the right part of the field then by default the data in this field should be displayed as circles, dots, asterisks or any other conventional signs depending on the customer's imagination. You also need to test the proper work of the switch button. It is usually displayed in the form of the eye.

4. Cross-browser testing.

Do not forget to test the password in different browsers. For example, in Safari there is a button for password adjustment and in case the developers have not considered this moment then this button might overlap with the toggle button next to it.

5. Old passwords.

The «Password» field exists not only in the registration form but on the personal data editing page as well. It is preferable for old passwords from one account to be kept in the database and the system should not allow changing the password to the one that has already been used. For security reasons, every new password must be different from the previous ones and unique within one account.

6. Rules hints.

The rules required for the user to fill in the password field should be displayed next to the field before the user submit the form.

7. The validation before and after submitting the form.

Testers should know when the fields are validated. On most modern websites, the tip with the list of made mistakes appears next to the field before the user submits the form.

9. Indicator of a strong password.

Usually, developers add it to encourage the user to create a more complex password for better account protection. When testing the indicator it is necessary to ensure that not only the number of characters but also the variety of their types are taken into account to determine the complexity.

These checks will help to test password fields, find the basic mistakes that interfere with the product interaction and prevent from going beyond the registration form. It is important to remember that users are the main critics and the first impression of the customer plays the most crucial role for any business.