Authentication

What is it?

Authentication is the end-to-end system by which users prove their identity to access a product. It encompasses account creation, login, password management, multi-factor authentication, social login (SSO), and session handling. Authentication is a trust-critical flow — it must be secure without being a barrier to legitimate users.

Why it matters

Authentication is the first experience every user has with your product. Friction here directly reduces activation rates. Poor authentication also creates security vulnerabilities that can destroy user trust through data breaches. The balance between security and usability is the central design challenge.

Best Practices

• Offer SSO (Google, GitHub, Apple Sign In) — reduces password fatigue and security risk.
• Magic links (passwordless) are both more secure than passwords and lower friction for most users.
• 2FA should be offered and encouraged, but not mandatory for low-risk applications.
• Password requirements should be shown during creation, not only on failure.
• Session length: balance security and usability — "Remember me for 30 days" is appropriate for most consumer products.
• Forgot password flow: ask only for email, send a time-limited reset link, confirm when sent.
• Don't confirm email existence on forgot password: "If an account exists, a reset email was sent."
• Failed login attempts: lock after 5–10 attempts, not after 3 (too aggressive).
• Session management: allow users to see and terminate active sessions.
• OAuth flows must redirect back to the original destination after login.

Common Mistakes

• No SSO options — forcing password-only authentication.
• Password requirements that are only revealed on failure.
• Forgot password that reveals account existence: "No account found with that email."
• Locking accounts after 3 failed attempts — too aggressive, blocks legitimate users.
• No 2FA option for users who want it.
• Session expiry without warning — users lose unsaved work when suddenly logged out.
• OAuth flows that don't redirect back to the page the user was on.
• Requiring email verification before allowing any product access — delays the aha moment.

Checklist

Research & Theory

Real-World Examples