January 27, 2026
Enter the Login Thunderdome
Designing Forms That Don't Get in the Way
Dev world melts down over magic links, username grabs, and red‑error anxiety
TLDR: A designer breaks down a gentle, password‑less login that checks usernames live and validates emails only after you’re done typing. Commenters split: UX fans say it’s human and calm; critics call magic links a hassle and question security and growth tactics—proof tiny form choices spark big feelings.
A calm little blog about making login forms kinder just detonated the comment sections. It started with a twist from the team at Evil Martians: instead of asking job applicants for a résumé, they want a link to your best login form. That set the tone—then this post walked through a password‑less flow for beenthere.page, where users claim a username first and only then enter email. Cue the internet.
The lovers of soft edges cheered the choice to validate emails only after you finish typing (no more screaming red boxes mid‑keystroke), and to check usernames live but gently, with a delay. “Finally, empathy,” they sighed. The skeptics fired back: magic‑link logins (where you click a link sent to your email) are “email handcuffs,” awful on planes, and risky when inboxes get weird. Another camp side‑eyed the split‑step wizard as a sneaky growth trick—“hook them with a name, harvest the email later.”
Security hawks fretted about real‑time username checks and user “enumeration,” while UX folks waved the Martian best practices and declared this the new baseline. Meanwhile, jokers memed the “Invalid email” panic flash, quipped “onBlur? I’m on bored,” and mocked reserved names like admin being off‑limits. The only thing everyone agreed on? Bad forms ruin mornings—and this one might actually chill them out.
Key Points
- •The author designed a password-less, username-first login/signup flow for beenthere.page.
- •The form uses a split-step wizard: validate username first, then collect email.
- •Email inputs are validated on blur to avoid interrupting users mid-typing.
- •Username inputs are validated on change, with client-side checks and a 500ms debounced availability API request.
- •The approach was influenced by Evil Martians’ hiring prompt and their article on best practices for login/sign-up forms.