Right now we have the possibility of using only 1 password and then we can add the confirmation (of the same password).
But I don´t want my customers blame some hacker guessing their only password.
Any tips about how I could do that?
My guess, maybe, could be having a traditional 1 password form and then opening a new popup asking for the second password. But I don´t know how to compare the content in both input boxes like “if password2´s value is not equal to Confirmation password2´s value… then… something”… like…error kind of.
On the user table add a field for the 2nd Password. use a text field
On user signup store the 2nd password to this field. I would suggest you do some salting and hashing.
When a user logins in, check the 2nd password first and then use the normal login methods on the normal password id the first check is ok.
Rather than a 2nd password, you might want to use a pin, this is more common than a second password. Other methods are a memorable word or place. or even a selection of characters from a word.
I’m with @vnihoul77 on that one. Double password is a very unusual thing to do. It creates additional friction in your sign-up form. And it will confuse your users. DON’T do it.
