In order to reduce the signup friction on our website, we are planning to delay the need for the users to set their password to a later step by asking them only their email address at the moment they join the website.

The workflow would then be something like this:

  1. A user signs up to the website entering his email address only
  2. We create a temporary password for him in the backend and use this password to log him in. The user can thus use the application as normal.
  3. We email the user a link that he will use to set his password later. This email serves also as a mean to confirm that the user's email address is correct.

I can't think of any drawbacks of using such a workflow but as it's not the standard we see elsewhere, am I missing something?

  • 1
    Unverified Emails? Spammers?
    – Harshal
    Commented Aug 18, 2016 at 10:47

1 Answer 1


While it's good that you are considering minimising the requirement of the user to create and account and login, as Harshal mentions, the initial question has to be what does giving authenticated access allow this user to do and would someone supplying fake details then have access to an area of the site that could elvate the opportunity for malicious actions. Remember every point of user supplied content is a security risk. (This is now another area of Stack Exchange.)

However I would suggest you need to at least confirm the email address, send a limited time token email with a direct access link in, then as part of the current visit ask the user to change their password. I would recommend against sending this request in an email as this would simulate phishing and should not be encouraged or normalised.

If there is a need to populate more user data you can send the user requests for this in an email after the initial or subsequent visits, but don't send any login requests as above.

The actual process you choose should be mapped against expected user journeys/stories that show the full lifecycle of the users off and online experience.

  • Thanks for your answer, I haven't thought about the "phishing" aspect of the thing until now... that's a good point! Commented Aug 22, 2016 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.