Sign-up form best practices
summary
Argues that the best login is no login and recommends guest checkout as the default for stores, or use client-side storage to avoid accounts. Specifies using federated login and optional password-free codes for new devices, and tells developers to enable browser password managers by coding forms correctly with autocomplete="new-password" and autocomplete="email", check passwords against Have I Been Pwned API, salt and hash on the back end, allow pasting, avoid forced resets, add change-password URL redirects and measure sign-up funnels and web vitals.
AI-written summary · about
chapters (11)
- 0:00Login necessity
- 1:08Sign-in best practices
- 1:47Simplifying signup
- 3:04Authentication methods
- 4:43Managing passwords
- 6:18Password security rules
- 7:33Backend security
- 9:33Federated login
- 10:49Account management
- 11:42Usernames and validation
- 12:29Analytics and performance
related talks
37mAuthentication in 2026: A guide to passkeys, digital credentials and more
47mThe state of passwordless auth on the web
37mBuilding simple and secure account systems on Android
14mBuild a signup flow that doesn't suck
29mDesigning Accessible Sign Up Forms
29mSecurity by(e) Design?
18mEffective password management
39mPasswords are so 1990 - Sam Bellen - PHP UK 2022