Process

Ask first, then build.

The steps change from project to project. Asking first doesn’t. Here’s how it could go on a password form everyone has fought. Try it first.

Pick a problem

Password formA web problemShowing

Fig. 1Try it: make an account

Create your accountOne password, and you’re in.EmailChoose a passwordStays on this page

Locked

Type anything, not a real password, and press Create account.

Step 1

Ask

The brief says “make people choose stronger passwords”. Before any pixels, I ask why they don’t. Every answer changes the brief a little.

Fig. 2Why are passwords weak?

Password1!the rules, working as designed

The briefMake people choose stronger passwords.
Why? 1Why are passwords weak?People pick something they can remember, then bend it to fit the rules.
Why? 2What do people do with the rules?A capital at the start, 1! at the end. password becomes Password1!.
Why? 3When does it go wrong?The rules show up one at a time, after you press the button. Then people forget what they made.
Why? 4What makes a password hard to guess?Length, and not being on a list of leaked passwords. Symbols barely help.

The real briefMake the strong password the easy one to make.

Step 2

I describe the options to Claude and get prototypes I can click, not boxes to imagine.

Fig. 3Three fixes, built to be clicked

Password field · prototypesClaude

People pick weak passwords, and our rules make it worse. Sketch three password fields I can click through.

Here are three quick prototypes. Each one is clickable:

••••••All the rules up frontFewer surprises. People still end up with Password1!.Open prototype ↗
PasswA live checklistNicer. It’s still the same rules.Open prototype ↗
Pickedmango rain on tuesdayOne rule: make it longA few words pass. Leaked passwords don’t.Open prototype ↗

Step 3

The winner is one rule: make it long. Then the catch: won’t people just type aaaaaaaaaaaa?

Fig. 4The obvious fix has a catch

Password · 12+ charactersType a passwordJust make it long.
1 · The ideaOne rule: make it longTwelve characters or more. A few words count.
Password · 12+ charactersaaaaaaaaaaaa✓ Strong password
2 · The catchaaaaaaaaaaaa passesLong enough, so the rule calls it strong.
Password · 12+ charactersaaaaaaaaaaaa✕ Too easy to guess. Try a few words.
3 · The fixAdd a leak checkLeaked and easy-to-guess passwords get a plain reason and a way forward.

Step 4

A handoff covers every way people fill the field, not just typing.

Fig. 5What the developers get

Password · 12+ charactersmango rain on tuesday✓ Strong. Easy to remember.

TypingThe bar fills with length. No rules pop up halfway.

Password · 12+ characterspassword123✕ Leaked before. Try a few words.

LeakedKnown leaked passwords get a plain reason.

Password · 12+ charactersmango rain on tuesday✓ Pasting always works.Paste

PastePasting is never blocked.

Password · 12+ characters•••••••••••••••••••✓ Filled by your password manager.Use suggested passwordQm7-vXr2-pLe9-tWz4

Password managerIt asks for a new password, so managers offer one.

Password · 12+ characters•••••••••••••••••••mango rain on tuesdayTap the eye to check it.

Show / hideOne tap to check what you typed.

To: the developersIn the handoff

Up nextA physical problem