Design Principle
Secure flows still need low cognitive load, helping users complete rather than testing them.
Principle Secure flows still need low cognitive load, helping users complete rather than testing them.
Design action Authentication flows provide clear labels, paste-friendly inputs, show/hide password, error explanation, resend/fallback paths, and reasonable timing.
Examples Positive example: Login, signup, 2FA, password recovery, and account security settings affect product access. Counterexample: Users must memorize a code from a previous screen or complex password rules.
Apply when Login, signup, 2FA, password recovery, and account security settings affect product access. Users need to judge state, scope, risk, or next action quickly.
Source notes Source note: Synthesized from W3C WCAG 2.2, Apple Accessibility, IBM Carbon Accessibility, and accessibility practices in major design systems.
Agent Directive
Authentication flows provide clear labels, paste-friendly inputs, show/hide password, error explanation, resend/fallback paths, and reasonable timing.