Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Many web sites ask users to enter their email address twice, sometimes taking the trouble to disable copy-pasting.

What is the logic behind this? Is this e.g. a security measure?

share|improve this question
can you provide an example of such site? –  shabunc Jul 17 '12 at 16:34
xkcd.com/970 –  mhoran_psprep Jul 17 '12 at 16:50
@shabunc: the example I most recently encountered is moneygram.com. –  9000 Jul 17 '12 at 16:51
I always thought it was because the web designers were not very good. –  thursdaysgeek Jul 17 '12 at 20:18
possible duplicate of What is the purpose of "re-type your email" field? –  Carson63000 Jul 18 '12 at 5:09
add comment

5 Answers

up vote 3 down vote accepted

I suspect a lot of it is "Grandma's Cooking Secret" programming where the programmer does it because they saw someone else do it. It's following tradition without thinking.

There could some logic originally behind it, such as users in 1996 not knowing that much about how to format email addresses. It could have been done then to avoid errors but then why not double every visible field? However, it probably isn't needed today and is an extra pain for mobile users.

Now, disabling copy/pasting and other tricks can be useful to prevent some automated spamming but they should be non-intrusive for the most part to normal users.

share|improve this answer
...probably isn't needed today... Are people suddenly less likely to make a mistake when entering an e-mail address or password? –  Caleb Jul 17 '12 at 17:09
It's not needed at all because I can see what I typed. Unlike passwords that are hidden with asterisks. Just because the field is important does not mean it needs to be entered twice. You are inconveniencing the majority of your users just to protect a handful of idiots. –  Tom Jul 17 '12 at 18:51
@Tom - Exactly. I've found it more and more inconvenient to deal with this kind of idiot proofing as I do more things from mobile platforms. –  jfrankcarr Jul 19 '12 at 14:02
@Caleb - Yes, they are because the format of email addresses is common knowledge to most people today. When a double opt-in verification process is used, this will eliminate incorrect emails and most spamming. –  jfrankcarr Jul 19 '12 at 14:05
Also, people are more likely to c&p now :) –  Jack V. Jul 23 '12 at 8:52
show 1 more comment

Short Answer: It is done to prevent the typo (mistakenly entering email address) !

Without this check, user may enter a wrong email address and never get registration feedback email, because he has entered wrong email address. In addition, this checking measure is prevent mass spamming by CaptCHA implementation in place.

share|improve this answer
How does it prevent pass spamming? I suppose that a robot fills form fields for a POST request not the way a human fills a web form. –  9000 Jul 17 '12 at 16:52
@9000, of course you need to have a CaptCHA implementation in place, if anonymous user can access the form codeproject.com/Articles/5947/CAPTCHA-Image –  Yusubov Jul 17 '12 at 17:01
better to mention that this can be easily done with more recent available tools. –  Yusubov Jul 17 '12 at 17:04
add comment

It is just the old way of confirming the email address. In old days, you had to enter the same email twice in order to verify it, in the new way, you have to click on a link inside the email to verify it. The new way is far better and makes the first one obsolete.

In this particular case, there is an extra emphasis on email just because it is money related site which is obvious. Other than that this method is not prevalent these days.

share|improve this answer
add comment

It's just to try and ensure that you enter the correct address, without typos. Since email addresses are usually the primary contact information for websites, it's considered worth the extra effort to try and make sure it gets entered correctly.

It's sometimes called two-pass verification.

share|improve this answer
This. The user identifier should be entered correctly or the system is inaccessible to said user (without at least the user doing some guess work as to her\his error). Copy-paste defeats this layer of validation since any errors in the original will be repeated. –  Peter Smith Jul 17 '12 at 16:55
Exactly right. You'll notice that the same technique is used when setting a new password and sometimes also when entering a long string of digits, such as a bank routing number or account number. –  Caleb Jul 17 '12 at 17:07
The same logic would make every shopping page ask for the shipping address twice. After all, if you don't enter the correct address, you won't get your product. It was done for password fields because they are hidden with asterisks. Doing the same for email addresses just doesn't make sense. –  Tom Jul 17 '12 at 18:59
But is not typing an email by hand more prone to errors than copy-pasting it from a well-known source, e.g. en email directed to me or a notes file? –  9000 Jul 17 '12 at 19:48
Everything that gets typed on a keyboard is prone to errors. If the user is concerned about errors, they should install form-filling software like Roboform or LastPass. IMHO, making a typo while entering your email address AND NOT CORRECTING IT YOURSELF is akin to misspelling your own name. –  Tom Jul 18 '12 at 12:24
show 5 more comments

I think it's simply because entering an email address is an error-prone activity. Making you type it twice makes you think about it.

I have no hard evidence for this.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.