Skip to content
UX Atlas
PatternCraft conventionIntermediate

Authentication

Signing in is a gate in front of the thing people came for, so every decision is about removing steps without removing safety.

Definition

Authentication covers sign-up, sign-in, recovery and elevation. It is the surface where security requirements and usability requirements meet most directly, and where the cost of a small annoyance is multiplied by every session.

Craft convention. True because the industry converged on it. Breaking it costs familiarity, not correctness.

On this page
  1. Definition
  2. Methods and what each costs
  3. The decisions that matter
  4. Reducing failed sign-ins
  5. In practice
  6. Sources
  7. Continue from here

Methods and what each costs

MethodGood forCost
Password with a managerUniversal, understood, portableReset traffic, reuse across sites, and rules that fight password managers.
Email or SMS codeNo password to remember or storeDelivery delay, inbox switching, and SMS interception risk.
PasskeysFast repeat sign-in, phishing resistantRecovery and multi-device support still confuse people, so keep a fallback.
Social or SSOOne click, no new credentialAccount fragmentation, and lock-out when the provider account changes.
Second factorReal protection for valuable accountsEvery prompt is a chance to lose someone. Reserve it for sensitive actions.

The decisions that matter

Do

  • Allow paste, autofill and password managers everywhere. Blocking them makes passwords weaker, not stronger.
  • State the password rules before the field is filled, and validate them on blur.
  • Say whether an account exists in a way you have decided deliberately, and be consistent about it.
  • Keep the reader where they were: after sign-in, return them to the page they asked for.
  • Offer recovery from the sign-in screen, not from a separate help page.

Do not

  • Do not force a password change on a schedule. Current guidance advises against it, and it produces predictable increments.
  • Do not use a single 'invalid credentials' message that also fires on a locked account. The reader cannot act on it.
  • Do not lose the form contents on a failed attempt.
  • Do not gate the whole product behind sign-up when a preview would convert better.

Reducing failed sign-ins

Most sign-in failures are recoverable in the interface rather than in the identity system.

  1. 1

    Keep the email visible

    On a two-step sign-in, show the address being used and make it editable without starting again.

  2. 2

    Name the failure honestly

    Expired link, locked account, wrong password and unverified email need different messages and different next actions.

  3. 3

    Make codes easy to use

    One input that accepts a pasted code, a numeric keyboard on mobile, and autocomplete attributes so the platform can fill it.

  4. 4

    Do not expire aggressively

    A magic link that expires in two minutes fails for anyone whose mail is delayed. Fifteen minutes costs little.

In practice

Guest checkout as an authentication decision

Forcing account creation before purchase is the highest-cost authentication decision most ecommerce products make. Offering the account after the order, prefilled from the details already entered, keeps the conversion and still creates the account.

Elevation instead of a permanent gate

Rather than requiring a second factor on every sign-in, a product can require it only when changing payout details or exporting customer data. The protection lands where the damage would be.

Sources

Where a source establishes something narrower than the popular reading of it, the note says so.

  • Digital Identity Guidelines, SP 800-63B

    NIST, 2017

    Source of the current advice against forced periodic password rotation and composition rules.

  • WCAG 2.2, Accessible Authentication (Minimum)

    W3C, 2023

Each link says what the connection is, so you can tell a principle from an alternative from a thing people mix this up with.

Depends on

Get these right first, or this one will not hold.

Often used with

These usually appear in the same screen or the same decision.

Practical example

A worked decision where this was the deciding factor.

Related concept

Connected closely enough to change how you apply this.