Why a Login Screen Is Never Just a Login Screen

Every project starts the same way. Someone sketches the login screen first because it feels like the easy part, the thing you knock out before the "real" work begins. Two fields, a button, maybe a forgot-password link. It looks like fifteen minutes of work.

It is not fifteen minutes of work. A login screen is where your session model, your password policy, your rate limiting, your error handling, and your compliance posture all have to agree with each other in public, in real time, in front of a stranger who just wants to get in.

Consider what happens when someone types the wrong password. Do you tell them "incorrect password," and hand an attacker a free way to enumerate valid emails? Do you say "invalid credentials" instead, and now support tickets pile up from confused real users who typo'd their email? Do you lock the account after five tries, and open the door to an attacker locking out every user you have just by hammering their emails? Every one of these is a real decision with tradeoffs, and someone on the team has to actually make it instead of inheriting whatever the auth library defaulted to.

Then there's the part nobody puts in the mockup: what happens during the six seconds between "click login" and "redirected to dashboard." Is the session token issued before or after the password is verified against a database that might be under load. Is there a race condition if the same user submits twice. What happens if the identity provider you depend on has a two-second outage. None of this shows up in a Figma file. All of it shows up in an incident report eventually, for someone.

We've rebuilt login flows for teams who had, on paper, "solved" this years ago. What we usually find isn't a broken idea, it's an accumulated pile of small, reasonable decisions that stopped being reasonable once the product grew ten times larger, added SSO, added a mobile app with its own token lifetime rules, and inherited three different password reset flows built by three different engineers in three different years. The login screen didn't get more complex on purpose. It got more complex the way sediment gets deposited: one layer at a time, none of them alarming on their own.

That's the actual craft in a project like this. Not typing out the HTML for a form, but designing the handful of rules that govern identity, trust, and failure so cleanly that five years from now, someone can still explain the whole system in one sitting. Anyone can ship a login page. Fewer people can ship one that's still legible after it's been extended fifty times.