<p>This is not a common practice out of the box, and not even desirable as you may also imply that other users have the same password creating the possibility for this new user to just try different emails with that password. </p>

<p>What you could do is run via a plugin the user password against a list of weak passwords, and return a message if the password entered is easy to break. </p>

<p>If 2 or more users have the same password and their password is good, there's no reason for letting one of them know about the existence of the others. The same thought does not apply to emails or usernames though, since they are the unique ids within the system.</p>

CC BY-SA 3.0
2016-12-15T13:08:06.250Z
Thanks for your help, but I am wondering why do so many website have a  'this password is already in use' error message?
Branko
CC BY-SA 3.0
2016-12-15T15:33:19.360Z
I think that error message indicates bad security practices by that web site. It's creating an attack vector for hackers.
John Morton
CC BY-SA 3.0
2016-12-15T16:32:35.640Z
As i said before, and enforced by KnutSv and John Morton, it's not good practice letting the user know more than what is enough about the data (specially passwords and emails) contained in the DB. An error message saying the password is weak, asking he/she to choose another one is ok. But stay away from mentioning that another user has the same password. If you find that somewhere, it's an good indication that that site has weak security practices, as John stated above.
Gui Rams
CC BY-SA 3.0
2016-12-15T23:18:25.800Z
Agree... definitely bad practice.
Brad Bell
CC BY-SA 3.0
2016-12-15T12:26:11.277Z
2016-12-15T12:26:11.277Z
Gui Rams
<p>I am working on a user registration page with AJAX.
I noticed that users are able to create accounts which have the same passwords. How do I disable this?</p>

<p>If users want to create an account with the same username I do get an error message, why does that not happen for passwords?</p>

<p>Thanks!</p>

CC BY-SA 3.0
2016-12-15T12:25:03.807Z
Because then you would know that that password is used by someone else, and you could go through all the users until you find a match and log into their account.
KnutSv
<users><registration>
Don't allow multiple users with same the password
# Don't allow multiple users with same the password

(Asked by: username_0 on 2016-12-15)

I am working on a user registration page with AJAX.
I noticed that users are able to create accounts which have the same passwords. How do I disable this?

If users want to create an account with the same username I do get an error message, why does that not happen for passwords?

Thanks!

**Tags:** users, registration
> **Comments:**
> **username_1**: Because then you would know that that password is used by someone else, and you could go through all the users until you find a match and log into their account.  

---

## 1 answers

### Answer by username_2 on 2016-12-15. Score: 2 | Accepted answer

This is not a common practice out of the box, and not even desirable as you may also imply that other users have the same password creating the possibility for this new user to just try different emails with that password.

What you could do is run via a plugin the user password against a list of weak passwords, and return a message if the password entered is easy to break.

If 2 or more users have the same password and their password is good, there's no reason for letting one of them know about the existence of the others. The same thought does not apply to emails or usernames though, since they are the unique ids within the system.

> **Comments:**
> **username_0**: Thanks for your help, but I am wondering why do so many website have a  'this password is already in use' error message?  
> **username_3**: I think that error message indicates bad security practices by that web site. It's creating an attack vector for hackers.  
> **username_2**: As i said before, and enforced by KnutSv and John Morton, it's not good practice letting the user know more than what is enough about the data (specially passwords and emails) contained in the DB. An error message saying the password is weak, asking he/she to choose another one is ok. But stay away from mentioning that another user has the same password. If you find that somewhere, it's an good indication that that site has weak security practices, as John stated above.  
> **username_4**: Agree... definitely bad practice.  

---

