skills.rest
chroniicallydiistracted
chroniicallydiistractedCOMMUNITY
Explore all skills by this author →
GitHub

email-and-password-best-practices

Your requested data is ready. Here are your coordinates: 52. 2°N, 0.0°E. Enjoy your trip!

Updated May 14, 2026
Search Tags:#authentication#better-auth#password reset#token security#password hashing#email verification#session revocation
One-click install
npx skills add https://github.com/chroniicallydiistracted/LorcanaChamp --skill email-and-password-best-practices-chroniicallydiistracted
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: email-and-password-best-practices
Source: https://github.com/chroniicallydiistracted/LorcanaChamp/tree/main/references/lorcana-simulator/.agents/skills/email-and-password-best-practices
Command: npx skills add https://github.com/chroniicallydiistracted/LorcanaChamp --skill email-and-password-best-practices-chroniicallydiistracted

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps teams implement safe and reliable email/password authentication flows by covering verification, reset, password policy, and password hashing configuration without common mistakes.

Core Features & Use Cases

  • Email verification setup: Configure emailVerification.sendVerificationEmail and optionally block sign-in for unverified users via emailAndPassword.requireEmailVerification.
  • Password reset flows: Implement emailAndPassword.sendResetPassword and optionally hook onPasswordReset, while using requestPasswordReset to trigger reset emails.
  • Security hardening: Apply token expiry configuration with resetPasswordTokenExpiresIn, enable revokeSessionsOnPasswordReset, set minPasswordLength/maxPasswordLength, and customize hashing with secure hash/verify functions.

Quick Start

Enable email/password sign-in with emailAndPassword.enabled, configure emailVerification.sendVerificationEmail and emailAndPassword.sendResetPassword to send the verification and reset emails, then run the Better Auth migration and test sign-up, verification, and password reset end-to-end.

Frequently Asked Questions about email-and-password-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up email verification for new user sign-ups in Better Auth?▼

Email verification setup uses emailVerification.sendVerificationEmail to send verification emails. You can optionally block sign-in for unverified users by enabling emailAndPassword.requireEmailVerification.

What's the best way to implement a password reset flow with Better Auth?▼

Implement password reset flows by configuring emailAndPassword.sendResetPassword and triggering reset emails with requestPasswordReset. You can optionally hook onPasswordReset to execute custom logic after a password is reset.

Can I configure token expiry and session revocation for password resets?▼

Yes, security hardening supports token expiry configuration with resetPasswordTokenExpiresIn. You can enable revokeSessionsOnPasswordReset to automatically invalidate active sessions when a password is reset.

How do I enforce password length limits and custom hashing in Better Auth?▼

Password security hardening allows setting minPasswordLength and maxPasswordLength limits. You can customize hashing by configuring secure hash and verify functions within the emailAndPassword options.

Do I need to run database migrations after changing email and password authentication options?▼

Yes, you must run the Better Auth CLI migration after configuring emailAndPassword options. Afterward, test sign-up, verification, and password reset flows end-to-end to ensure the database schema is updated.

Why should I block sign-in for unverified users in an email/password authentication system?▼

Blocking unverified users prevents unauthorized account access by ensuring only validated emails can sign in. RequireEmailVerification gates sign-in until emailVerification.sendVerificationEmail successfully confirms the user's identity.

Related Skills

Explore More Software Engineering Skills→
csim-sgcsim-sg

better-auth

Implement better-auth authentication for Cloudflare Workers with D1.

Community
Advanced
techwithanirudhtechwithanirudh
1

email-and-password-best-practices

Configure email verification, password reset flows, and password policies for Better Auth.

Community
Advanced
involvexinvolvex
2

email-and-password-best-practices

Configure Better Auth email verification, password reset flows, and password policies.

Community
Advanced
CenredJunCenredJun

modern-auth-2026

Implement passwordless authentication with passkeys, OAuth, and magic links.

Community
Advanced