What is a password hint?
Definition
A password hint is a short clue a person saves with an account to help them remember their password, shown to them when they can't log in. Security guidance says hints that anyone can see are a risk.
- Category
- Security
- Also called
- password reminder, password clue
- Last updated
Some accounts and devices let you save a hint when you set a password: a phrase such as "first dog plus year" that is shown on the login screen after a failed attempt. The idea is to jog your memory without showing the password itself.
The problem is that the hint is visible to whoever is at the login screen, not just you. NIST's digital identity guidelines (SP 800-63B) say that services must not let a user store a hint that is accessible to an unauthenticated person. A hint like "my daughter's name and birth year" is exactly what someone who knows you, or who has read your social media, can use to guess the password.
Password hints and security questions
Both try to help you get back in, and both lean on facts about your life. Answers such as a pet's name or a school are often easy to find. NIST also advises services against asking users to pick from knowledge-based prompts like these.
What works better
A password manager remembers the password for you, so there is nothing to hint at. If you do forget a password, use the service's reset process by email or an authenticator rather than a hint.
How to protect yourself
- 1
Don't set a hint if you can skip it
If a device or site makes it optional, leave it empty.
- 2
Never put part of the password in the hint
A hint like "Summer + year" gives an attacker a head start.
- 3
Use a password manager
It stores a long random password per account, so you never need a reminder.
- 4
Turn on two-step verification
If a password is guessed, a second factor can still stop the login.
- 5
Keep personal facts off public pages
Hints and security answers often use details that are public. Serus finds where your personal details are listed online and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Are password hints safe?
Not when anyone can see them. NIST's guidance says services must not allow a hint to be shown to someone who has not logged in. Use a password manager or a reset flow instead.
What should I do if I forgot my password?
Use the service's official reset option, usually a link sent to your recovery email or phone. Don't use a link from an unexpected message.
What is a good password hint?
The safest hint is none. If you must write one, make it meaningless to anyone but you and never include part of the password.
Sources
Something wrong or out of date? Tell us and we'll re-check it.