I am redesigning a social network which uses login via Facebook or an email signup/login. In the case of email signup/login users needs to just give their email address and we will send a confirmation link. Once the link is clicked, we take it as confirmation of the user identity and they can continue.

This session is stored in browser cookies and hence the user doesn't need to sign in again the next time. There is an optional password setting flow, but we are not making that obvious. In the event the user tries to login again from another machine (or after clearing cache), we again ask them to input an email, and the same email acts as either a new user signup or as an access token to an already signed up user.

We are not too happy with the workflow now for few reasons.

  1. The new email design from Gmail, often pushes our access link emails out of a new users' primary mailbox.
  2. In mobiles especially this going back and checking the email is becoming a cumbersome activity
  3. Users are not really getting the workflow as they usually expect an immediate password field or an access to the app. We are giving the message to check the emails, but for some reason, there is drop off at this stage.

We are thinking of introducing the password box now, but reverting back to the tried and tested email/password collection upfront leaves a lot of questions unanswered. We don't know the legitimacy of the users. This will force us to check the email credentials again with another workflow, which we want to avoid.

Any thoughts?

  • If I understand you correctly, I can just visit your site, try random mail addresses from my address book and see if my friends are registered there? If they are registered, I can easily log in and change their data? Seems really unsecure for me.
    – Reeno
    Oct 31, 2013 at 13:25
  • Yeah I wanted to understand that too, is that how a user can log in? Is there another safety guard that will block unwanted logins?
    – UXerUIer
    Oct 31, 2013 at 14:32
  • Sorry for the confusion. Let me clarify. If you give an email id, we will send the access link to the email. In the eg. you are asking, if you have given the email of a friend, we will just tell you that a link has been sent to the email id given (we wont say its already registered or not). When your friend receive the email link, they click on it will be taken to an activation page. They could decide to claim it or drop there. There is no need to create a password, since everytime this email will act as an access key. So you dont access anything till u activate the email. Nov 1, 2013 at 4:33

2 Answers 2


Here is the signup workflow Tumblr uses:

  1. Sign up with e-mail/password
  2. Log user in (and send them the verification link)
  3. Allow user to operate main functions of the site
  4. Once the user does something that really requires verification stop the user and ask them to verify (see picture below).

    enter image description here

  5. When the user clicks "Send it again" the user is brought back to the main section of the page with a warning at the top of the page.

enter image description here

I like this method because segmenting the signup process from the e-mail verification process makes the whole signup experience seem fast and painless.

Also, you want to get users into your site immediately. I think the traditional method of requiring e-mail verification before allowing site access has the risk of losing potential users at the verification step.


If I understood it correctly, you have already decided to go back to the email + password solution, and your concern now is to avoid requesting email validation (as a new signup) all over again. Right? Well, in that case, you could simply generate a random password for each existing user, send the passwords to their registered email and put a notice in the main page saying that the password has been sent. You can also add a button saying "resend first password" or something like this, and make clearer the update password option in the workflow once they are logged in.

Though, I would love to know what is the reason you decided originally to avoid requesting passwords? Also, are your customers all users of mobile phones? Did you consider having a QRCode app or something similar to do the login (similarly to what banks do when confirming electronic payments)?

  • I would be very careful when sending someone's password via email, since that's been proven to be an insecure method of delivery. I would suggest that you send them a temporary link to where they can set up their passwords.
    – UXerUIer
    Oct 31, 2013 at 14:31
  • Yes, you are right @Majed. Oct 31, 2013 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.