Design Principle
Secure flows still need low cognitive load, helping users complete rather than testing them.
Principle
Secure flows still need low cognitive load, helping users complete rather than testing them.
Design action
Authentication flows provide clear labels, paste-friendly inputs, show/hide password, error explanation, resend/fallback paths, and reasonable timing.
Examples
Positive example: Login, signup, 2FA, password recovery, and account security settings affect product access. Counterexample: Users must memorize a code from a previous screen or complex password rules.
Apply when
Login, signup, 2FA, password recovery, and account security settings affect product access. Users need to judge state, scope, risk, or next action quickly.
Source notes
Source note: Synthesized from W3C WCAG 2.2, Apple Accessibility, IBM Carbon Accessibility, and accessibility practices in major design systems. WCAG 2.2: https://www.w3.org/TR/WCAG22/ WCAG Contrast Minimum: https://www.w3.org/WAI/WCAG21/Understanding/contrast-minimum.html WCAG Non-text Contrast: https://www.w3.org/WAI/WCAG22/Understanding/non-text-contrast.html Apple HIG Accessibility: https://developer.apple.com/design/human-interface-guidelines/accessibility Carbon Accessibility Overview: https://carbondesignsystem.com/guidelines/accessibility/overview/
Agent Directive
Authentication flows provide clear labels, paste-friendly inputs, show/hide password, error explanation, resend/fallback paths, and reasonable timing.