If you are printing 5x7 dot matrix characters in red on a black background, you are going to have serious problems no matter what symbols you use. The guidelines are intended to make sure all text is legible and require you to have a fairly high degree of control over the final display. The only published guidelines I know of are about making sure that any text displayed is legible by appropriate choice and usage of fonts, contract, size, etc. Whether or not this increases or decreases the mental load of your users could be the topic of some quick user testing.Īs mentions, this strategy is employed by Crockford's Base32 encoding scheme. This is sacrificing only a hair of entropy for the convenience of automatically resolving ambiguities in the passcode. There is another solution to consider: if you do not want to limit the character set of the generated code (which, in my opinion, is probably the easiest solution), simply accept both I/ 1 and O/ 0 in each others' places. Option: Accepting ambiguous characters interchangeably each state in the United States determines its own manner in which it issues license plates), however, most states will omit the letters I, O, and often Q to help mitigate some of the ambiguity. There is some variation in license plate implementations (e.g. Much like the passcode your mention here, the alphanumeric sequences 1) appear to be just a random assortment of meaningless characters, and 2) must be unambiguously legible.

Option: Eliminating ambiguityĬonveniently, this same problem is present in another common use case: automobile license plates. There are no standard guidelines of which I am aware what I've observed most often is that, when dealing with issues of security like this one, companies prefer to evaluate their own security model and implement what they feel is best for their interests, rather than adopt a one-size-fits-all standard model. In other instances, 2 factor authentication can allow a user to simply verify themselves on the trusted device to give access to the untrusted device. If it is an option, the application should offer to copy-paste the passcode for the user. The character count and ambiguity of the numbers and letters don't matter if the user can use the passcode without memorizing it. This is the golden solution to eliminate ambiguity and reduce short-term memory load. Lastpass on iOS does this well by assigning a different color to letters, numbers, and special characters. 01OlB8Ĭolor can easily help differientate characters as well. Reduce Short-term memory load ( Shneiderman's Golden Rule of Interface Desgin #8)īelow is an example of how the mono-spaced font differentiates characters often confused with one another.Keep it Simple ( Lund's Usability Maxims #10).Error Prevention: eliminate error prone conditions ( NNGroup Usability Heuristic #5).There is no UX guideline specific to passwords, but several usability heuristics can be applied to this use case: But if you the passcode it shows you is Z35O96 it's not going to be obvious to large percentage of users if that's a letter O or a number zero. Note: Obviously if you have 0 and O next to each other you can probably tell them apart. Get the code wrong and you have to re-fill out the form and solve the 10-15 second puzzle again Is that code BB1CA1O8? BB1CA108 ? BB1CA1D8? Apple doesn't have the UX problem above because their passcodes are only digits, no letters.Ĭonversely some other site had a 10-15 second puzzle to solve, once solved it showed a code

A passcode is something a computer creates like emailing you a 6 character code to type in.įor example Apple will popup a 6 digit number, a passcode, on an registered Apple device when you try to log into. A password is something a user can possibly create. Note: this question is not about passwords, it's about passcodes (maybe there is another name). Next to each other sometimes these are more obvious but in a random code it's not always clear.ĭo such guidelines exist and are there any other characters that should be avoided? Maybe ! is another one? This would seem like it should be a common UX guideline, never generate codes with those characters. I i l 1 can also be indistinguishable depending on the type style. In particular I just ran into a site that used auto-generated codes but the codes it made were impossible to tell if a letter was a D an O or a 0. Is there any kind of guidelines on passcode generation with regards to UX?

Password generator lastpass