email-and-password-best-practices

What problem does it solve? Setting up secure email/password authentication involves many moving parts—verification emails, reset flows, token expiry, session revocation, and hashing algorithms—and misconfiguring any of them creates security gaps. This Skill provides the correct Better Auth configuration patterns for each of these concerns. ## Core Features & Use Cases - Email Verification Setup: Configure sendVerificationEmail and optionally block sign-in until verification with requireEmailVerification. - Password Reset Flows: Implement sendResetPassword, control token expiry, revoke sessions on reset, and handle background tasks on serverless platforms. - Password Policies & Hashing: Set min/max password lengths and swap the default scrypt hashing for Argon2id via custom hash and verify functions. - Use Case: You are adding credential-based sign-up and login to a SvelteKit app with Better Auth and need verification emails, a secure reset flow, and Argon2id hashing configured correctly on the first pass. ## Quick Start Ask the AI to configure Better Auth email and password authentication with email verification, a password reset flow, and Argon2id hashing in your auth config file.