Sign up that converts

Google is the fastest form of authentication and over 60% of users choose it.

• Google sign up takes under 5 seconds
• Friction is minimal since most users are already logged into Google
• Profile data (name, avatar, email) is copied to your application

Clerk handles the unique edge cases that arise across different social providers.

• If a provider such as GitHub does not return a verified email, Clerk automatically verifies the email inline
• When a required phone number is missing, the authentication flow triggers a prompt for the user to supply it

Password validation is built to adhere to NIST 800-63B guidance for “memorized secrets.”

• Enforce minimum 8 characters
• Automatically disallow breached passwords
• Non-compliant composition rules (e.g. symbol and capitalization requirements) can be enabled

If a user tries to sign up with a password found in a data breach by HaveIBeenPwned, <SignUp/> rejects it.

One-time passwords are the fastest way to securely verify an email or phone number.

• You can also choose to let your users verify at a later time after sign-up
• The 6-digit OTP is placed first so it appears in previews and avoids extra clicks

Despite the name, “magic” links convert slower than OTPs sent by email. We don't recommend them, but they're supported if you want them.

User enumeration allows attackers to discover who's created accounts in your application. By default, mass enumeration is blocked with rate limiting, while strict enumeration protection can be enabled to prevent targeted attacks.

• 1
  An attacker checks if andy@gmail.com has an account by trying to sign up and checking if the error says an account already exists.
• 2
  With strict enumeration protection enabled, the sign up flow continues regardless, even if Andy already has an account.
• 3
  If Andy does have an account, he receives an email warning that someone tried to sign up. If it was Andy, and not an attacker, the email informs him to sign in.

Protect yourself from fraud, spam, and abuse, while minimizing friction for real end-users.

Protect against fictitious and malicious sign ups proactively.

• Email subaddress blocking
• Disposable email address blocking
• Rate limits per device and IP to mitigate sign-up fraud
• Country code restrictions

Restrict sign-ups to invite-only access, or integrate <Waitlist/> to capture interest and roll-out your application gradually.