email-and-password-best-practices

What problem does it solve? Setting up secure email/password authentication with Better Auth involves many moving parts—verification emails, reset flows, token expiry, session revocation, and hashing algorithms—and misconfiguring any of them creates security gaps or broken user flows. ## Core Features & Use Cases - Email Verification Setup: Configure sendVerificationEmail and optionally block sign-in until verification with requireEmailVerification. - Password Reset Flows: Implement sendResetPassword, control token expiry, revoke sessions on reset, and handle background tasks on serverless platforms. - Password Policies & Hashing: Set min/max password lengths and swap the default scrypt hashing for Argon2id via custom hash and verify functions. - Use Case: You are adding credential-based sign-up and login to an Astro or Node.js app with Better Auth and need verification emails, a secure reset flow, and Argon2id hashing configured correctly the first time. ## Quick Start Ask the AI to configure Better Auth email and password authentication with email verification, a password reset flow, and Argon2id hashing in your auth config file.