Account access.
WHAT TO ASK AT SIGN-UP
The minimum.
Everything else can be collected later, in context.
WHAT TO AVOID
Requiring an account before a person has any reason to want one Long forms before any value is delivered
WHAT TO MAKE CLEAR
What happens next Whether confirmation is required
WHAT TO DESIGN CAREFULLY
Password requirements.
WHAT TO DO
State the rules before they type, not after rejection Allow long passwords and all characters Allow pasting Offer to reveal what was typed
WHAT NOT TO REQUIRE
Arbitrary complexity rules that produce predictable passwords.
WHAT TO PROVIDE ON SIGN-IN
A visible route to reset A clear message when credentials are wrong, without revealing which part
WHAT TO PRESERVE
The address they entered, after a failed attempt.
WHAT TO DO AFTER SIGN-IN
Return them where they were going.
WHAT TO TEST
The whole path, including reset, on a phone.
