skills.rest
GELLIFY
GELLIFYOFFICIAL
Explore all skills by this author →
GitHub

email-and-password-best-practices

Implement secure email and password authentication with Better Auth.

6|8|Updated May 9, 2024
Search Tags:#security#authentication#better-auth#hashing#password reset#email verification
One-click install
npx skills add https://github.com/GELLIFY/acme-app --skill email-and-password-best-practices-gellify
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: email-and-password-best-practices
Source: https://github.com/GELLIFY/acme-app/tree/main/.agents/skills/email-and-password-best-practices
Command: npx skills add https://github.com/GELLIFY/acme-app --skill email-and-password-best-practices-gellify

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides essential guidance and enforcement rules for implementing secure email and password authentication, ensuring user data protection and a robust authentication system.

Core Features & Use Cases

  • Email Verification: Enforces email verification to prevent fake sign-ups and ensure user email validity.
  • Password Reset Flows: Guides through setting up secure password reset mechanisms with built-in security considerations like timing attack prevention and token security.
  • Password Hashing: Details secure password hashing using scrypt by default and options for custom algorithms like Argon2id.
  • Use Case: Implementing a new user registration system that requires email verification and provides a secure password reset flow for users who forget their passwords.

Quick Start

Configure email verification by setting emailVerification.sendVerificationEmail to your email sending function.

Frequently Asked Questions about email-and-password-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement secure email verification to prevent fake sign-ups?▼

Secure email verification prevents fake sign-ups by enforcing email validity through a configured sendVerificationEmail function, sending tokens to users to confirm ownership before activating the account.

What's the best way to hash passwords using Better Auth?▼

The best way to hash passwords using Better Auth is utilizing the default scrypt algorithm, or configuring custom hashing algorithms like Argon2id to securely store user credentials.

How do I set up a password reset flow with timing attack prevention?▼

A secure password reset flow requires generating secure tokens and implementing timing attack prevention to avoid user enumeration, ensuring consistent response times regardless of email validity.

Do I need email verification enabled if I already have password hashing configured?▼

Yes, enabling email verification alongside password hashing is essential to ensure user email validity and prevent fake sign-ups, while hashing protects the actual credentials stored in your database.

Can I use Argon2id instead of scrypt for password hashing?▼

Yes, you can use Argon2id instead of scrypt for password hashing by configuring a custom algorithm, allowing you to meet specific security requirements or organizational standards.

Related Skills

Explore More Software Engineering Skills→
panaversitypanaversity
16

email-and-password-best-practices

Implement email verification and password reset flows with Better Auth.

Official
Intermediate
Sumeet138Sumeet138
1

auth-implementation-patterns

Implement JWT, OAuth2, and RBAC authentication for web services.

Community
Advanced
SkobynSkobyn

hunt-brute-force

Detect login brute force, OTP/2FA brute force, and credential stuffing vulnerabilities.

Community
Advanced
CenredJunCenredJun

modern-auth-2026

Implement passwordless authentication with passkeys, OAuth, and magic links.

Community
Advanced