Normally, if a user inputs an already-registered email, they are told that it's already taken and offered to switch to the login form.

However, if they enter a valid email/password combo, should they be logged in or should I just say that the email is taken?

2 Answers 2


If they are trying to register an existing e-mail, I would direct them (in the 'it's already taken' message) to the login page, AND to the password recovery page.

That will let them get in if they know their credentials, and recover them if they don't.


There are several things to notice here; one is the consideration of actually telling one that an e-mail address is already taken; as this helps both hackers and decreases privacy. An example for the latter is, say that one of my friends has registered on a NSFW-site, I could just check which one of my friends are on it,...and blackmail them! Something to think about.

Now, to try and answer your question, I'll start with a question: Why are people having a difficulty to actually differentiate between the register and login phase of your website? Perhaps some things are, in fact, unclear. You could, for instance, stop the auto-pilot, by asking the user to confirm their password once more.

Another way is to accomodate as much as possible, by simply allowing the use of SSO (Single Sign-On) options like logging in with facebook, twitter, ...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.