email-and-password-best-practices: a Claude Code skill by Better Auth

Official

For TypeScript developers adding email and password login with Better Auth. Skip it if your app uses another auth library or only social sign-in.

Copy install command View the source

Score: 75of 100
Rank: #120of 239
Installs: 50.1Kon skills.sh
Security: Mixed 5 scanners
Updated: Oct 192026
Context: ~79tokens always

Install

npx skills add https://github.com/better-auth/skills --skill email-and-password-best-practices

Run it in your terminal. View the source

Using the Claude app rather than Claude Code? You can add a skill there too. How to add it in the app

What does email-and-password-best-practices do?

email-and-password-best-practices is a Claude skill that sets up email and password sign-in for apps built on Better Auth. It walks Claude through five steps: turn on emailAndPassword, add a sendVerificationEmail function, add sendResetPassword for reset links, run npx auth@latest migrate, then test a sign-up. It covers blocking sign-in until the email is verified, absolute callback URLs, reset token lifetime, single-use tokens, ending all sessions after a reset, and minimum and maximum password length. Hashing uses scrypt by default. It shows how to swap in Argon2id through custom hash and verify functions, and warns that existing users cannot sign in after a switch without a migration plan.

When should you use email-and-password-best-practices?

Use it when

Adding sign-up, sign-in and password reset to a Better Auth app
Requiring verified email before users can log in
Switching password hashing to Argon2id

Skip it when

Your project does not use Better Auth
You only offer OAuth or magic link sign-in

What it needs and what it can touch

You need

A project using Better Auth
Your own function or service for sending email

What it can do

Edits your Better Auth configuration files
Runs the Better Auth migration through npx

From reading its instructions, not from running it.

Why it scores 75

Strongest on upkeep (100 of 100), weakest on adoption (46).

Adoption35 points 46
Upkeep20 points 100
Trust20 points 82
Quality15 points 100
Reader answers10 points Not enough answers yet, so this does not count

How the formula works

Is email-and-password-best-practices safe to install?

At least one scanner raised a medium warning. Read the results below. Scanners often miss what other scanners catch, and a skill can change after a scan. Read its source before you install it.

Scanner	Result	Date
Gen Agent Trust Hub	Passed	Sep 15, 2026
Socket	Passed	Sep 15, 2026
Snyk	Low risk	Sep 15, 2026
Runlayer	Medium risk	Mar 3, 2026
ZeroLeaks	Passed	Apr 16, 2026

Details

Installs: 50,138
Repository stars: 229
Last repository change: Oct 19, 2026
Tokens always loaded: about 79
Tokens when used: about 1,419
License: Not stated
Data confidence: High

Alternatives to email-and-password-best-practices

All skills for this job

better-auth-best-practices

For TypeScript developers setting up or changing Better Auth sign-in, sessions and plugins.

Score 79 132K installs Official

Get better-auth-best-practices
clerk-setup

For developers adding Clerk sign-in to a web or mobile app through the Clerk CLI.

Score 74 59.1K installs Official

Get clerk-setup
better-auth-security-best-practices

For developers running Better Auth who want to lock down sessions, cookies and sign-in limits before launch.

Score 76 51K installs Official

Get better-auth-security-best-practices
Firebase skills

For app developers on Firebase who want Claude to run the CLI for setup, sign-in, hosting and Gemini features.

Score 80 184K installs Official

Get Firebase skills