# No custom fields should appear after "Password" on signup?

**URL:** https://meta.discourse.org/t/no-custom-fields-should-appear-after-password-on-signup/241089
**Category:** UX
**Tags:** user-custom-fields
**Created:** [October 6, 2022, 2:28am UTC](https://meta.discourse.org/t/no-custom-fields-should-appear-after-password-on-signup/241089 "2022-10-06T02:28:50Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [October 6, 2022, 2:28am UTC](https://meta.discourse.org/t/no-custom-fields-should-appear-after-password-on-signup/241089/1 "2022-10-06T02:28:50Z")

</div>

On a forum with a custom “Pronouns” field enabled, at least one user accidentally pasted their password into the “Pronouns” box.

Presumably they were running on autopilot and pasted their password thinking it was a “password confirmation” field like we’ve been conditioned to do over the last [too many] years.

Perhaps we could help people avoid this mistake by preventing any custom fields appearing after the “Password” field.

Or, run custom fields to ensure they _aren’t_ the user’s password… kind of a weirdly-specific thing to check though. 🤷

Exhibit A: meta’s signup form:

 ![image](https://global.discourse-cdn.com/meta/original/4X/6/4/8/648200ab5aaaa2f9f5af83a696f9a18cd6a87cb2.png)

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 10, 2022, 10:59pm UTC](https://meta.discourse.org/t/no-custom-fields-should-appear-after-password-on-signup/241089/4 "2022-10-10T22:59:15Z")

</div>

Quick update… @nbianca just implemented a validation here:

[https://github.com/discourse/discourse/commit/dc89b72d465329b041b0b26be4e6176343288176](https://github.com/discourse/discourse/commit/dc89b72d465329b041b0b26be4e6176343288176)

This means that we will simply reject signups in future if people make this mistake.

Longer term there may be something better we can do in the UI to avoid this upfront, but the big vector here is now sealed.

---

<div class="post-metadata">

### Author: ![darkpixlz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/darkpixlz/32/549896_2.png) [@darkpixlz](https://meta.discourse.org/u/darkpixlz)
#### Post date: [October 10, 2022, 11:30pm UTC](https://meta.discourse.org/t/no-custom-fields-should-appear-after-password-on-signup/241089/5 "2022-10-10T23:30:13Z")

</div>

Can this apply to emails too?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 11, 2022, 2:03am UTC](https://meta.discourse.org/t/no-custom-fields-should-appear-after-password-on-signup/241089/7 "2022-10-11T02:03:28Z")

</div>

Great suggestion, but I would like to see this fail in the real world before rushing to fix. The position of email makes this less likely to happen.

I can imagine cases where people include emails in custom fields and they happen to be the same email you registered.

I guess a change I support is “check the password/name/username is not the email” - do we have that covered @nbianca ?

---

<div class="post-metadata">

### Author: ![darkpixlz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/darkpixlz/32/549896_2.png) [@darkpixlz](https://meta.discourse.org/u/darkpixlz)
#### Post date: [October 11, 2022, 2:04am UTC](https://meta.discourse.org/t/no-custom-fields-should-appear-after-password-on-signup/241089/8 "2022-10-11T02:04:37Z")

</div>

Yep. Definitely a few times I have entered the password because I expect a “Confirm your password” prompt, but it’s just a custom field.