Should I bother asking users to "confirm password"?

IMO: No, do not ask them to confirm the password if they've already confirmed their email (which they can use to reset their password if they mistype it). If they haven't yet confirmed their email, then sure, ask them to confirm the password. But they could still make a mistake (e.g. if they copied from the wrong password in their password finder and then pasted it twice).

It does highlight an interesting race condition of sorts. You can avoid this by forcing the user to confirm their email before they can change their password. But what if they signup while mistyping their password, then logout before confirming their email? Will their account be stranded? If they haven't confirmed their email then you probably don't want to send a password reset request to it, right? (Or maybe you do?)

It makes more sense to confirm the email or have the second step in the register process be "Click the link we sent to your email..." You can't do "forgot password?" if the email is wrong.

Ultimately it boils down to how much friction your users are willing to tolerate. Or how often you want field emails from users who can't reset their PW and you find a typo in their email address in the DB

Just require them to sign up with a mobile number and SMS.

/s

No, don't do that. Unless you really need to.

I do request 'confirm password' but that was from feedback that users expect to input a password twice for a new account and it seems to add no friction.

No. Further, don't use a "password" field that shows dots or asterisks for characters.

It's almost impossible to type on a cellphone "keyboard".

The threat of shoulder surfing is basically eliminated by tiny smartphone screens and font, held close to the face.

I don't mind as long as you don't interfere with copy/paste (password manager just auto-fills both for me).

You can make the confirmation optional like: https://ph.leftium.com/

While you're at it, drop password rules that prevent strong, pronounceable/typeable passwords generated by my password manager like:

`lumpy empower susie classic sly stoppage calculate backache`

It's much easier to type random words than random characters, especially on mobile keyboards. Symbols, numbers, and even upper case are more annoying to type.

Not if you provide the option to view the password as plainly visible text too. If it's obscured always, then yes.

Don't make me repeat my email, unless you're obscuring that too.