TL;DR
Get privacy and security gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
Error messages should tell people what they can safely do next, without exposing whether an account exists, private data, credentials, or internal system details. Keep public responses clear and consistent, and put necessary diagnostics in access-controlled logs with secrets and personal data redacted.
A login page can give away a secret with just one extra word. “Wrong password” may confirm that an email address belongs to an account, while “No account found” says it outright. Neither message needs to show a hacker a password for it to create a privacy problem.
Error messages are part of an application’s security boundary. They should help legitimate users recover from a problem, while keeping account details, private data, and system internals out of public view. That balance matters in websites, apps, and APIs: the message is only one clue, and status codes, timing, logs, and support tools can reveal more.
This guide walks through what a useful error can say, what it should keep private, and how teams can still investigate failures. You’ll also see practical examples, from a forgotten password to a payment form that accidentally echoes what you just typed.
Use neutral sign-in and reset responses when account existence is sensitive, and check timing and status differences too.
Never display passwords, session IDs, reset tokens, API keys, or another person’s private records in errors.
Keep stack traces and infrastructure details out of production responses; put needed diagnostics in protected tools.
Use a random correlation ID to connect a user’s report to an access-controlled diagnostic record.
Review public messages, API metadata, logs, and monitoring captures because each can disclose information.
Give users a next step without giving away the secret
What error messages should not reveal is sensitive information a person doesn’t need to fix the immediate problem: whether an account exists, another person’s data, credentials, or the application’s internal workings. A good public error offers a safe next move instead. Think of it like a frosted window: enough light to find the door, no view into someone else’s room.
Imagine you enter your email on a password-reset page. “No account found” tells you the address is not registered. “Instructions sent” after every request can protect that detail, but it should not falsely promise delivery. A more accurate response is “If an account matches that address, we’ll send instructions.” It sets expectations and avoids confirming someone’s account status.
Clarity still matters. “Something went wrong” gives you no idea whether to check a field, retry later, or contact support. A message like “We couldn’t sign you in. Check your details or reset your password” gives you two useful options without declaring which credential failed. It respects the user’s time while limiting what an outsider can learn.
A useful error explains the next safe action; protected diagnostics explain what failed inside.
This balance can vary by situation. A form may safely say “Enter a valid date” when a date is missing, because the message explains how to complete the form. But if revealing whether a health record, invoice, or account exists would expose private information, the response needs more care. The audience and sensitivity of the information determine how much detail belongs on screen.
As an affiliate, we earn on qualifying purchases.
Keep account status and login clues out of sign-in errors
What error messages should not reveal in a sign-in flow includes whether an email address or username is registered. One response that says “wrong password” and another that says “unknown user” can turn a login form into a directory. The safer pattern combines them: “We couldn’t sign you in. Check your details or reset your password.”
The wording isn’t the whole story. If an unknown account gets a fast response and a real account takes longer, repeated requests may reveal a pattern. The same is true if one case returns a different status code or a noticeably larger response. A consistent outward response helps close those gaps, especially when automated tools can send many requests quickly.
Suppose a small community group uses email addresses as usernames. Someone signs in with a neighbor’s address and sees “Account locked.” That message confirms both the account and a security state. A combined response can instead direct the legitimate account holder to recovery, where appropriate checks happen through a protected process.
Use this practical checklist when designing account-related errors:
- Use a neutral public message for sign-in, registration, and reset flows when account existence is sensitive.
- Compare the full response, including status code, size, headers, and timing, across unknown-account and wrong-password cases.
- Offer a recovery route that lets the account holder prove control without revealing account state to everyone.
- Review lockout and rate-limit messages so they don’t disclose which defenses activated or how an attacker could adapt.
This approach has a tradeoff: people may wonder whether a reset email was sent. The wording can acknowledge that uncertainty plainly, and the interface can explain where to check next. The goal is not to make every response identical in every application. It is to avoid exposing account facts where those facts are private.
secure login error message display
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Remove secrets, personal data, and raw input from the response
What error messages should not reveal includes passwords, session IDs, reset tokens, API keys, authorization headers, payment details, health records, and another person’s information. These values can show up in surprising places: a validation message, a crash report, a browser console, or a support transcript. A red warning banner doesn’t make a secret safe to display.
Picture a checkout form that rejects a card and repeats the full card number beside “Payment failed.” The user may take a screenshot to ask for help, then post it in a support chat. The better message is “We couldn’t process that payment. Check the details or try another payment method.” If support needs a reference, provide an order ID or a random request ID, not the card number.
Raw input also carries risk. If an app prints a value supplied by a user into an HTML page without encoding it for that context, the page may treat the value as markup rather than text. A safer design avoids echoing submitted content when it isn’t needed; when it is needed, the application should display it as text using the right output encoding.
These habits apply to logs too. A private monitoring tool can still be visible to many staff members or a third-party service. Teams should redact secrets and personal data, limit who can view diagnostic records, and set retention periods that match a real support need. “It’s only in the logs” is not a guarantee that the information stays contained.
For example, a developer investigating a failed reset might need the error category and a request ID, but not the reset token itself. Keeping those apart makes the failure easier to trace without turning diagnostic records into a second store of sensitive credentials.
diagnostic log management software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Keep stack traces and infrastructure details behind the scenes
What error messages should not reveal includes implementation details that help someone map the system: stack traces, source paths, database queries, table names, framework versions, internal hostnames, cloud resource names, and dependency details. These fragments may look meaningless to a customer, but they can help a reader understand how the application is built and where it might fail.
Consider an API that responds to a bad request with a database error containing a table name and a query fragment. The client only needs a stable error code and a plain explanation, such as “This request couldn’t be processed. Check the required fields and try again.” Developers can investigate the full exception in a protected monitoring system, linked by a correlation ID.
Cloud and serverless applications need the same care. A provider-generated response may mention a region, bucket, service, or internal resource name even if the application’s own error page is tidy. Review failures from the whole request path: application code, gateway, database, identity provider, and third-party service. A polished custom 404 page won’t replace authorization checks, either; a hidden URL is not a lock on the door.
APIs benefit from a documented error format with a stable code, a safe message, and an optional request ID. That gives a mobile app or other client a predictable way to respond, while exception traces stay out of production responses. For instance, a client can show “Upload failed. Try again” and include a request ID if the user contacts support.
Detailed traces remain useful in development and operations. The boundary is who can see them, where they are stored, and whether they contain secrets. Production errors should help the client recover; protected diagnostics should help the team find the fault.
As an affiliate, we earn on qualifying purchases.
Match each error to the person who needs to act
What error messages should not reveal depends partly on who will read them. A customer needs a clear action; an API client needs a stable response it can handle; a support agent may need a request reference; a developer needs protected diagnostic context. Sending the same raw exception to all four is like handing every visitor the building’s maintenance key.
Take a failed photo upload. The person using the app needs to know whether to try again or choose a smaller file. The API client may need a safe code such as “upload_unavailable.” Support can use a correlation ID to find the event, while the engineering team checks a restricted trace showing the service timeout. Each audience gets enough to do its job, and no more.
Correlation IDs work only when they don’t carry hidden meaning. Use a random or otherwise non-sensitive identifier; don’t encode an email address, customer number, timestamp with private significance, or internal routing detail into something displayed to a user. A short reference such as “Request ID: 8F2K…” can connect a conversation to a protected record without exposing the record itself.
Teams can make this separation easier by deciding in advance what each audience needs:
- Users: plain language, a safe next action, and a support route when needed.
- API clients: stable codes and consistent response formats.
- Support: the request ID and an approved view of relevant diagnostic facts.
- Developers: detailed errors in access-controlled tools with redaction and retention rules.
This division can reduce support friction rather than add it. A customer who sees “Your upload failed; try again” can explain the problem, and the request ID lets support investigate without asking them to paste private data into a chat.
Check the response, timing, and logs—not just the words
What error messages should not reveal can leak through more than visible text. Status codes, response size, headers, delays, retries, and logs may expose account or system state too. Review the whole failure path as a visitor or client would experience it, then check what internal tools record about the same event.
For a password reset, compare the experience for a registered address and an address with no account. Do the public messages match? Does one take longer? Does one return a different status code? Similar checks apply to authorization errors: a person should not gain access just because a page hides its contents or returns a vague message. The access control itself must still reject unauthorized requests.
Logs deserve their own review. An error-reporting service might capture an entire request body, including a customer’s address or a password typed into the wrong field. AI-assisted coding and observability tools can send traces or prompts to external systems, so teams should inspect what they collect and redact sensitive values before storage or sharing.
A realistic review might start with a deliberately invalid checkout, a rejected upload, and a failed sign-in. For each one, record what appears in the interface, API response, browser console, support view, and monitoring system. You’re looking for useful guidance in the public channel and unnecessary data in every channel.
Guidance from OWASP and secure development frameworks has long treated error handling as part of secure design: avoid verbose production errors, protect logs, and prevent account enumeration. The underlying practice still applies across modern APIs and distributed services. Specific duties vary by system and jurisdiction, so teams should check the rules that apply to their data and industry.
Write errors people can understand and act on
What error messages should not reveal may get the security team’s attention, but the words still need to help the person on the other side of the screen. A safe message should name the problem at a useful level, avoid blame, and offer a next step. “Invalid operation” is quiet, but it leaves someone stranded.
Imagine you upload a family photo from a phone on a weak connection. “Request entity exceeded configured maximum” sounds like a door slammed by a machine. “This file is too large. Choose one under 20 MB” tells you what happened and how to continue. The limit is safe to disclose because it helps complete the task without exposing private records or internal architecture.
Accessibility matters here. Use plain words, don’t rely on color alone to signal an error, and place the message near the field or action that needs attention. If a form has three fields, “Check the highlighted field” is useful only if a screen reader and a person using a small phone can identify which field failed.
Before shipping a message, ask three questions: Can the reader understand what happened? Is there a safe action they can take? Does the wording reveal private state, secrets, or implementation details? For example, “We couldn’t save your changes. Check your connection and try again” may be more useful than a raw timeout message, while still giving the user a sensible route forward.
“Generic” and “helpful” aren’t opposites. You can keep a sensitive reason private and still explain the next action clearly. When an error needs more help, give a support route and a safe reference ID instead of asking the user to copy diagnostic text into a public message.
Frequently Asked Questions
Should every error message be generic?
No. A useful message can explain a safe action, such as choosing a smaller file or checking a required field. Keep details generic when a specific explanation would expose account status, private data, credentials, or system internals.
Is it safe to say “wrong password”?
It can confirm that the account exists, especially if an unknown username gets a different response. Where account enumeration is a risk, combine the cases into a sign-in message that asks the person to check their details or use account recovery.
Should an API return a stack trace in production?
No. Return a stable error code and a safe explanation that a client can handle. Keep the stack trace in an access-controlled diagnostic system, and use a request ID to connect a report to the right record.
Can an error reveal an account even if the wording is neutral?
Yes. Different status codes, response sizes, headers, or timing can reveal the same account distinction. Compare the complete responses for matching and non-matching addresses, not just the visible sentence.
Are logs safe because users cannot see them?
No. Logs may be available to many staff members or sent to outside monitoring tools, and they can contain secrets or personal data. Restrict access, redact sensitive values, and keep records only as long as they serve a real need.
Conclusion
Give people the next safe step, and keep the sensitive explanation in protected diagnostics. That one habit can make an error clearer for a real user and less revealing to someone probing the system. Check the message, the status code, the timing, and the logs together.
A good error is a small signpost on a foggy road: it points you toward recovery without lighting up every room behind it.
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
