--- title: Password sign-in best practices | daily.dev description: Firebase and Google Cloud Identity Platform outline best practices for securing password-based sign-in: restricting API keys, promoting password managers and... canonical: https://daily.dev/posts/password-sign-in-best-practices-28naviggs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Password sign-in best practices | daily.dev og:description: Firebase and Google Cloud Identity Platform outline best practices for securing password-based sign-in: restricting API keys, promoting password managers and... og:url: https://daily.dev/posts/password-sign-in-best-practices-28naviggs og:image: https://api.daily.dev/og/posts/28NAvIGgs.png og:image:alt: Password sign-in best practices og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Password sign-in best practices **[Firebase](https://daily.dev/sources/firebase-blog)** · 5 min read · 0 upvotes · 0 comments ## Summary Firebase and Google Cloud Identity Platform outline best practices for securing password-based sign-in: restricting API keys, promoting password managers and One Tap sign-in, enforcing password policies, enabling email enumeration protection and App Check, adding multi-factor authentication for sensitive apps, preferring social or email-link sign-in over passwords, and using phone authentication for users without email. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Should I use passwords or email link sign-in with Firebase Authentication if I'm not implementing MFA? Email link sign-in is preferred over password-based sign-in without multi-factor authentication because it requires legitimate users to have access to their email account to sign in successfully. Firebase recommends migrating existing password users to email link sign-in and disabling password-based sign-in when possible, since password databases are frequently leaked and reused across sites. _Teams weighing authentication trade-offs in Firebase can find comparisons like this on daily.dev._ ### How can I protect my Firebase app from email enumeration attacks? Google Cloud Identity Platform offers a built-in email enumeration protection feature that prevents attackers from confirming valid user accounts by passing email addresses to the authentication API and checking responses. It is enabled by following Identity Platform's admin configuration steps for email enumeration protection, guarding against this common brute-force reconnaissance technique. _Developers hardening auth flows against enumeration attacks can track such guidance on daily.dev._ ### What are the security risks of using phone number authentication instead of email in an app? Phone authentication has caveats: possession of a phone number can be transferred between users, and on devices with multiple user profiles, anyone who can receive SMS messages on that device can sign in to an account tied to the phone number. It remains useful for users without email addresses, but these risks should factor into the authentication design. _Developers choosing between phone, email, and social sign-in methods can compare trade-offs on daily.dev._ ## Similar posts on daily.dev - [Understanding Authentication Methods](https://daily.dev/posts/understanding-authentication-methods-jmj3klhzw) · Security Boulevard · 0 upvotes · 0 comments - [Modernize authentication with passkeys, digital credentials, and more](https://daily.dev/posts/modernize-authentication-with-passkeys-digital-credentials-and-more-nzvsxhett) · Chrome Developers · 1 upvotes · 0 comments - [Is Your Google Workspace as Secure as You Think it is?](https://daily.dev/posts/is-your-google-workspace-as-secure-as-you-think-it-is--nlebehkck) · The Hacker News · 1 upvotes · 0 comments - [Streamline User Journeys with Verified Email via Credential Manager](https://daily.dev/posts/streamline-user-journeys-with-verified-email-via-credential-manager-qxsxzc7o2) · Android Developers Blog · 1 upvotes · 0 comments - [Authentication Provider Types: A Guide to Best Practices](https://daily.dev/posts/authentication-provider-types-a-guide-to-best-practices-ujx0dewj2) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#firebase](https://daily.dev/tags/firebase) [View this post on daily.dev](https://daily.dev/posts/password-sign-in-best-practices-28naviggs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Password sign-in best practices","url":"https://daily.dev/posts/password-sign-in-best-practices-28naviggs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/password-sign-in-best-practices-28naviggs"},"datePublished":"2026-08-23T12:20:42.630Z","dateModified":"2026-08-23T12:43:14.812Z","description":"Firebase and Google Cloud Identity Platform outline best practices for securing password-based sign-in: restricting API keys, promoting password managers and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ed721de96163685d26ab7e314be3ebc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7ed721de96163685d26ab7e314be3ebc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Firebase","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Firebase","logo":"https://media.daily.dev/image/upload/s--i395oqZH--/f_auto,q_auto/v1787487448/logos/firebase-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/firebase-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/password-sign-in-best-practices-28naviggs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,firebase","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Firebase","item":"https://daily.dev/sources/firebase-blog"},{"@type":"ListItem","position":3,"name":"Password sign-in best practices"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/password-sign-in-best-practices-28naviggs#faq","mainEntity":[{"@type":"Question","name":"Should I use passwords or email link sign-in with Firebase Authentication if I'm not implementing MFA?","acceptedAnswer":{"@type":"Answer","text":"Email link sign-in is preferred over password-based sign-in without multi-factor authentication because it requires legitimate users to have access to their email account to sign in successfully. Firebase recommends migrating existing password users to email link sign-in and disabling password-based sign-in when possible, since password databases are frequently leaked and reused across sites. Teams weighing authentication trade-offs in Firebase can find comparisons like this on daily.dev."}},{"@type":"Question","name":"How can I protect my Firebase app from email enumeration attacks?","acceptedAnswer":{"@type":"Answer","text":"Google Cloud Identity Platform offers a built-in email enumeration protection feature that prevents attackers from confirming valid user accounts by passing email addresses to the authentication API and checking responses. It is enabled by following Identity Platform's admin configuration steps for email enumeration protection, guarding against this common brute-force reconnaissance technique. Developers hardening auth flows against enumeration attacks can track such guidance on daily.dev."}},{"@type":"Question","name":"What are the security risks of using phone number authentication instead of email in an app?","acceptedAnswer":{"@type":"Answer","text":"Phone authentication has caveats: possession of a phone number can be transferred between users, and on devices with multiple user profiles, anyone who can receive SMS messages on that device can sign in to an account tied to the phone number. It remains useful for users without email addresses, but these risks should factor into the authentication design. Developers choosing between phone, email, and social sign-in methods can compare trade-offs on daily.dev."}}]} ```