email-and-password-best-practices

Name: email-and-password-best-practices
Availability: InStock
Author: Better Auth

Configure Better Auth email verification, password resets, and hashing settings.

206|30|Updated Oct 20, 2025

Search Tags:#security #authentication #verification #email #password-reset #password-auth

Ready to run

npx skills add https://github.com/better-auth/skills --skill email-and-password-best-practices

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: email-and-password-best-practices
Source: https://github.com/better-auth/skills/tree/main/better-auth/emailAndPassword
Command: npx skills add https://github.com/better-auth/skills --skill email-and-password-best-practices

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secures user authentication by providing guidance and enforcement rules for implementing secure email/password authentication with Better Auth.

Core Features & Use Cases

Guidance on enabling and enforcing email verification to reduce fake sign-ups.
Password reset flows with customizable sendResetPassword function and secure token management.
Configuration options for verification, token expiration, and session revocation to improve security.
Use Case: A developer configures email verification and password resets for a new app.
Security considerations and best practices, including redirect validation and password policy.

Quick Start

Configure your Better Auth setup to require email verification and enable password reset with a secure token, then deploy your app.

Frequently Asked Questions about email-and-password-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure email verification for user sign-ups in Better Auth?▼

Configure email verification in Better Auth by enabling the emailAndPassword option, which enforces verification rules to reduce fake sign-ups and secure new user authentication flows.

What is the best way to implement a secure password reset flow?▼

Implement a secure password reset flow by configuring Better Auth with a customizable sendResetPassword function, secure token management, and specific token expiration settings to handle password recovery safely.

How does session revocation work during password resets or email changes?▼

Session revocation during password resets and email changes works by configuring Better Auth to invalidate active user sessions, ensuring that compromised or outdated authentication states are immediately terminated.

Can I customize password hashing settings and redirect validation in Better Auth?▼

Better Auth allows you to customize password hashing settings and enforce redirect validation, ensuring that authentication callbacks and password storage mechanisms align with your application's security policies.

What are the limitations of using email and password authentication for backend services?▼

Email and password authentication requires careful handling of token expiration, redirect validation, and session revocation to mitigate risks, and it relies on developers enforcing strict password policies to avoid vulnerabilities.