Strong Passwords Suggested by the iPhone

A password nobody has to invent

Apple released iOS 12 yesterday. When someone creates an account on a website in Safari, the iPhone can now offer a strong password of its own, save it to the person's iCloud Keychain, and fill it in next time.

The customer accepts it with one tap. They never type it, never need to remember it, and are less tempted to reuse the password they use everywhere else.

For a site with customer accounts, such as an online store, a booking system or a client portal, that is a straightforward gain.

It depends on two things: the phone recognising the form, and the form accepting what the phone suggests.

Safari 12 on Macs does the same, so the change reaches many desktops too.

What the iPhone now does with passwords

• Suggests a strong password on sign-up and change-password forms.
• Fills saved logins with a tap above the keyboard.
• Offers codes from text messages in verification fields.
• Flags reused passwords in the phone's password settings.
• Accepts other password apps as a source for filling logins.

The first only happens when Safari concludes the form is for creating a password. It decides from clues in the page, and a form that offers none may simply get no suggestion.

Telling the phone what each field is for

The clearest clue is the autocomplete attribute, a short label in the form's code stating the purpose of a field.

On a sign-up or change-password form, the password field should say new-password. On a login form, it should say current-password.

The email address or user name people sign in with should say username, even when it is an email address. A field for a code sent by text message should say one-time-code.

None of this changes how the form looks. It changes whether the phone can help.

Twenty characters and two hyphens

By default the suggested password is twenty characters long: lowercase letters, one capital, one digit and two hyphens.

That is far stronger than most passwords people invent. It also breaks a surprising number of sign-up forms.

A form allowing no more than twelve or sixteen characters rejects it. So does one that forbids hyphens, or insists on a symbol from a short approved list that leaves the hyphen out.

The customer sees an error straight after the phone has offered them the best password they have ever had. Some type something weaker instead. Some give up.

Rules worth dropping

Most password rules on small business sites were copied from somewhere years ago, and few of them protect anything.

A low maximum length serves no purpose on a properly built site, since stored passwords are scrambled into a fixed length whatever goes in. Bans on particular characters are usually the same story.

Length is what makes a password strong. A sensible minimum, with room for at least sixty-four characters and any character allowed, accepts the phone's suggestion and every password manager's.

Ask whoever maintains the site how passwords are stored before loosening anything, since a site that cannot take long passwords may have a deeper problem.

Stating the rules you keep

Where a rule has to stay, Safari 12 can follow it. A newer attribute called passwordrules lets the form state its requirements: minimum and maximum length, and which kinds of character are required or allowed.

Safari reads it and generates a password that fits. Other browsers ignore it, so the rules still need writing beside the field, where people typing their own passwords will see them before the error does.

A worked example

A maternity and baby store on a busy suburban street runs a gift registry on its website. Expecting parents create an account, add items, and share the list with family.

Its sign-up form required eight to twelve characters, including one of four listed symbols. The fields carried no autocomplete labels, and the login form called the email field Registry ID.

In August, on an iPhone running the public test version of iOS 12, the owner tried to create a registry. The phone offered a strong password, and the form rejected it twice before she typed one of her own.

The developer who looks after the store removed the maximum and the symbol rule, kept a minimum of ten characters, and added the right labels to every account field.

The login form's first field is now labelled Email address. The same test on a phone now accepts the suggestion, saves it, and fills it in at the next login.

Codes sent by text message

Some sites confirm a new account or a login with a code sent by text. iOS 12 reads the code from the incoming message and offers it above the keyboard.

Apple's notes say it looks for a number near the word code, so a message such as "your verification code is 482913" works better than a bare number.

With the one-time-code label on the field, the customer never leaves the page to copy six digits from another app.

Account pages on plain HTTP

Since the spring, Safari on the iPhone has warned people who start typing a password into a page that is not encrypted, and Chrome now marks every plain HTTP page as not secure.

Account pages belong on HTTPS before any of the above. A strong password typed into an unencrypted page is still sent in the open.

The counter-case

Many small business sites have no customer accounts at all, and nothing here applies to them.

A store selling mostly to one-time buyers may also do better with a guest checkout, leaving passwords to the customers who choose to register.

Forms supplied by a booking or store platform can only be changed by that platform, so the job there is asking the right questions rather than editing code.

Wherever customers do create accounts, though, the form should recognise the phone's help and accept it.

Before the next sign-up

1. Create a test account on an iPhone with iOS 12.
2. Note whether a password is suggested.
3. Check the suggestion is accepted.
4. Remove low maximums and character bans.
5. Add autocomplete labels to account fields.
6. Label any text-message code field one-time-code.
7. Log in again and check it fills.

Step four does the most good. A form that rejects a twenty-character password turns the phone's best suggestion into the customer's first error on your site.

What visitors see in the address bar while they sign up is covered in the word secure leaves Chrome's address bar.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.