Undo
Reversing the last action, which is the single highest-value safety mechanism in most products.
Definition
Undo reverses a completed action, restoring the previous state. It replaces most confirmation dialogs and makes exploration safe, which changes how willing users are to learn by trying.
Expert heuristic. A review criterion developed by practitioners. Useful and widely taught, but evaluated by judgement rather than measurement.
On this plate
Reach for this when
- Any reversible action.
- Replacing confirmation dialogs.
- Building content creation tools.
Common mistakes
- Undo only available in a toast.
- Windows too short to be useful.
- Scope that does not match user expectation.
- Offering undo in a toast that vanishes, while the action itself was permanent.
Implementation decisions that matter
- Scope: is undo global, per document, or per surface? Users expect it to reverse the last thing they did, whatever that was.
- Duration: long enough to notice the mistake. A four-second toast is not long enough for most people.
- Reachability: the keyboard shortcut, a menu entry and an inline control, not only a transient message.
- Depth: multiple levels where feasible, and a clear statement of the limit where not.
- Collaboration: in shared documents, undo should reverse your own action, not someone else's.
What undo has to cover
| Decision | Options | Note |
|---|---|---|
| Scope | Last action, or a history | A history needs stable names for each step |
| Window | Seconds in a toast, or permanent | Say which, at the moment of the action |
| Reach | This device, or the account | A collaborative product needs to answer this explicitly |
| Conflicts | What happens if someone else edited since | The case that decides how hard this is |
| Discoverability | A visible control, not only a shortcut | Ctrl+Z is invisible to most readers |
Ways to make something reversible
Undo is one mechanism among several. The right one depends on how long the reader might take to notice.
- A command history, reversing the last action and the ones before it, for editing surfaces.
- Soft delete with a trash, for anything a person might miss a day later.
- Version history, for documents, where the reader wants a point in time rather than a step count.
- A send delay of a few seconds, which converts an irreversible action into a cancellable one at almost no cost.
- Drafts and autosave, which make an interrupted session recoverable rather than lost.
- An export, which is the last resort reversibility for anything the product itself cannot restore.
Undo people can find
Do
- Put a visible control beside the result of the action, as well as on the shortcut.
- Keep the offer long enough to notice the mistake, and say how long it lasts.
- Say what was undone afterwards, so the reader can tell it worked.
- Undo the reader's own last action in a shared document, not whatever happened most recently.
Do not
- Rely on a toast that vanishes in four seconds as the only route.
- Offer undo for something the server has already made permanent.
- Silently drop the undo stack on navigation, so the option was real and then was not.
- Undo a batch as one step when the reader expected to reverse a single item.
Three windows, and the reader has to know which one applies
In practice
- i.
Undo instead of confirm
Mail and task toolsSend with a short undo window replaced the confirm-before-send dialog and is now the expected behaviour. Nobody is interrupted, and the mistake is still recoverable.
- ii.
Undo instead of asking
What it replacesReplacing a confirmation dialogue with an immediate action plus undo removes an interruption from every correct use and keeps the protection for the rare mistake. That trade is why undo is the stronger pattern.
Commonly confused with
Close neighbours that get substituted for each other. The difference is stated first, then the condition that picks one over the other.
Confirmation
PatternA prompt that requires approval before an action is carried out.
Key difference
Confirmation asks before, and taxes every action to catch the rare mistake. Undo forgives after, and costs nothing when the reader was right. Reach for confirmation only where undo is genuinely impossible.
Use Undo when
- The previous state can be restored.
- The action is frequent, and a prompt would be dismissed by reflex.
- You want people to explore without fear of breaking something.
Use Confirmation when
- The action truly cannot be reversed, such as a permanent deletion.
- It is rare enough that the prompt will still be read.
- The consequence reaches beyond the reader, as with sending or publishing.
Local chart
PAT·022 · Region III · Grid F2
This entry and the entries it is stated to connect with. Each line is labelled with what the connection means.
Continue from here
Each link says what the connection is, so you can tell a principle from an alternative from a thing people mix this up with.
Applies when you are designing
Principles behind this
The reasoning this solution is an application of.
- Error PreventionHEUR·005 · Heuristic
- User Control and FreedomHEUR·003 · Heuristic
- ForgivenessPRIN·006 · Principle
Depends on
Get these right first, or this one will not hold.
- Keyboard NavigationA11Y·002 · Accessibility
Often used with
These usually appear in the same screen or the same decision.
- ToastCMP·014 · Component
- CollaborationPAT·026 · Pattern
- Destructive ActionsPAT·009 · Pattern
Related concept
Connected closely enough to change how you apply this.
- Confirmation and Destructive CopyWRT·012 · UX writing