Install: "Repeat Password" is not required when browser js is disabled

[ramiy]

Recreate:

1. Turn off browser JS.
2. Install WordPress.
3. Go to step 2.

The "Repeat Password" field is marked as required. It's not.

---

Recreate this step by step:

Leave all fields empty and press the install button.
You will see an error saying: Please provide a valid username.

Enter invalid username (use spaces).
You will see an error saying: The username you provided has invalid characters.

Enter valid username.
You will see an error saying: You must provide an email address.

Enter some text (not an email).
You will see this error message: Sorry, that isn’t a valid email address. Email addresses look like username@example.com.

If you provide a valid email, it will install WordPress. Password is not required!

[ramiy]

The patch removes the (required) strings from the Repeat Password field.

[ramiy]

One more thing, when changing passwords for existing users (user-edit.php) or changing your own password (profile.php) this field is not marked as required.

[ramiy]

When you enter only the new password and update (without repeating the password), you will see an error message saying ERROR: Please enter the same password in both password fields.

When you do that on install screen, you will see an error saying: Your passwords do not match. Please try again.

[bookdude13]

Hey @raimy, thanks for the ticket! Sorry it took so long for a response.

I just checked this on the latest version and it seems that the repeated password is required for an install. Leaving both blank leads to a password being generated. All other fields act the same as when you saw this.

Since this appears to have been fixed, marking this as close.

[bookdude13]

When password is only entered in one of the two fields (same either way)

[bookdude13]

When no password is entered, one is generated.

[bookdude13]

On second thought, if the username and emails are actually required, why aren't those inputs (and the first password box) marked as required?

And why is the repeat password box marked as required with text and not with a red asterisk like most forms nowadays?

[joedolson]

Giving this the accessibility focus, as we need to ensure that all of these fields are accurately marked according to how they're actually required.

From this report, it sounds like the second password is only conditionally required; *if* the first password is added, then the second is required. Otherwise, it's not.

• Need to verify that this is still true.
• Need to verify that the other apparently required fields are, in fact, required.

[joedolson]

I'm going to milestone this for 7.2, although there have been quite a few changes and improvements to these screens in the last 7 years, so it may be that this is already resolved.

[afercia]

I re-tested the install flow with JS off and I think things work a little differently now.

• Disable JS in your browser.
• Follow the installation step and go to step 2.
• Both passwords fields are shown. Note that with JS on only one password field is shown.

At this point, there are two scenarios:

1. Enter something in the Passwword field and leave 'Repeat Password' empty: You will get an error message: Your passwords do not match. Please try again.
2. Leave both fields empty and submit. WordPress will be installed. As reported already in comment:6 a password ​will be auto-generated by wp_generate_password(). Also, a user meta will be set to display the 'default password nag'.

See also the screenshots below.

Overall, both fields don't need to be required. The text (required) is misleading. It would be best to remove it.

One more small improvements would be hiding the button to 'Hide' the password when JS is off because with no JS it doesn't do anything. We should consider adding the CSS class hide-if-no-js to that button.

[afercia]

Auto-generated password after leaving both fields empty.

[afercia]

The default password nag admin notice shown after first login.

[afercia]

The Hide button should be hidden when JS is off

[afercia]

For better clarity, the form should inform users that if they do not enter any password, one will be auto-generated for them _before_ they submit.
A simple message after both password fields would clarify things.

Trac ticket: https://core.trac.wordpress.org/ticket/36098#comment:12

Use of AI Tools

None

[afercia]

In ​https://github.com/WordPress/wordpress-develop/pull/13635

• Remove the text (required) from the Repeat Password label.
• Add a paragraph that is only shown when JS is off after the Repeat Password input field, with text: You can leave the password fields empty and a password will be auto-generated for you.
• Always show the text: 'Important: You will need this password to log in. Please store it in a secure location.' as there is no reason to hide it when JS is off.
• Make sure the 'Hide' button is hidden when JS is off.

Screenshots before and after

[afercia]

In 64095:

Login and Registration: Clarify the password fields on the install screen are not required when JS is off.

When JavaScript support is disabled in the browser, the form at the second step of the installation flow shows two fields: Password and Repeat Password. Both fields are not required. When leaving both fields empty, WordPress will auto-generate a password and display it in the following step. Note that when JavaScript support is enabled, only one password field is shown and it is required.

This change clarifies the fields are not required. Also, improves accessibility by adding proper descriptions.

• Removes the text '(required)' from the Repeat Password label.
• Always shows the description: 'Important: You will need this password to log in. Please store it in a secure location.' as there is no reason to hide it when JS is off.
• Adds a paragraph after the Repeat Password input field that is only shown when JS is off, with text: You can leave both password fields empty and one will be auto-generated for you..
• Makes sure the 'Hide' button is hidden when JS is off.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13635

Props ramiy, bookdude13, joedolson, afercia.
Fixes #36098.