auth

A challenge placed in a form to sort people from scripts, from distorted text to a single checkbox that watches how you got there.

The control inside a password field, usually an eye or the word Show, that switches the characters between masked and readable.

A row of single character boxes for a short code, where typing advances to the next box and pasting the whole code fills them all.

Replacing a sign-up form at the front door with a first useful action, so the reader experiences value before being asked for anything.

Letting a buyer complete a purchase without creating an account, with the offer to save details moved to after the order is placed.

A form field hidden from people but visible to automated form fillers, used to reject submissions that fill it in without challenging anyone.

Letting someone use a product and accumulate state anonymously, and asking for an account only when that state needs to survive the session.

Signing in by clicking a single-use link emailed on request, with no password, and a screen that waits and offers to resend while the mail arrives.

Signing in by typing a short code sent to a second channel, keeping the reader inside the app rather than sending them out to a mail client.

Signing in with a device-held credential unlocked by the reader's own biometric or screen lock, so the interface asks for a face or fingerprint, not a secret.

A gauge that scores a password while it is typed and names what would improve it, replacing a list of rules with continuous feedback.

Explaining why access is needed in the product's own dialog first, and only firing the operating system prompt once the reader has said yes to that.

Collecting profile details a few at a time across separate visits, instead of demanding the whole record in one long form at registration.

Signing in by delegating identity to an existing account elsewhere, presented as a row of provider buttons above or instead of a password form.

Guarding a destructive action by making the reader type the name of the thing being destroyed before the confirm button becomes usable.

A sign-in route that never requires a cognitive function test such as recalling a password or solving a puzzle without offering an alternative.