Creating Email and Password Registration and Login in Android

Course: Android App Development

Topic: Creating Email and Password Registration and Login

Course Link: Android App Development Course

Demo Link: Register for a Course Demo

JustAcademy Website: Visit JustAcademy

1. Introduction to Email and Password Authentication

Email and password authentication is a common method of verifying a user's identity in an Android application. Users create accounts using their email addresses and passwords, then use those credentials to sign in whenever they return.

Firebase Authentication provides ready-made APIs for creating accounts, signing in, signing out, managing authentication state, and supporting account recovery. It reduces the need to build and maintain a custom authentication server.

For example, an Android learning application can allow students to register with their email addresses, log in to access courses, and sign out when they finish using the application.

Learning Objectives

• Understand email and password authentication.
• Configure Firebase Authentication in Android Studio.
• Enable the Email/Password provider in Firebase Console.
• Create new user accounts.
• Authenticate existing users.
• Validate email addresses and passwords.
• Handle authentication success and failure.
• Manage the current user's session.
• Implement sign-out and password recovery.
• Apply authentication security best practices.

2. Understanding Authentication and Authorization

Authentication and authorization are related concepts, but they serve different purposes in application security.

Firebase Authentication handles identity verification, but access to Firestore, Realtime Database, and Cloud Storage must also be protected through appropriate security rules.

3. How Firebase Email and Password Authentication Works

Firebase Authentication manages account credentials and verifies sign-in requests. The Android application communicates with Firebase through the Firebase Authentication SDK.

Registration Flow

User Opens Registration Screen
            |
            v
Enters Email and Password
            |
            v
Application Validates Input
            |
            v
Firebase createUserWithEmailAndPassword()
            |
            v
Firebase Creates the Account
            |
            v
Authentication Success or Error
            |
            v
Display Result and Update UI

Login Flow

User Opens Login Screen
          |
          v
Enters Email and Password
          |
          v
Application Validates Input
          |
          v
Firebase signInWithEmailAndPassword()
          |
          v
Firebase Verifies Credentials
          |
          v
Login Success or Error
          |
          v
Open the Appropriate Screen

Main Firebase Authentication Methods

4. Prerequisites for Firebase Authentication

Before implementing registration and login, prepare an Android project and connect it to a Firebase project.

• Android Studio installed on the development computer.
• An Android project using Kotlin or Java.
• A Google account for Firebase Console.
• A registered Android application in Firebase.
• The Firebase configuration file, google-services.json.
• The Firebase Authentication SDK dependency.
• An internet connection for communicating with Firebase services.

Creating a Firebase Project

1. Open Firebase Console.
2. Create a new project or open an existing project.
3. Register your Android application using its exact application ID.
4. Download the google-services.json configuration file.
5. Place the file in the app module's root directory.
6. Configure the Google Services Gradle plugin.
7. Add the Firebase Authentication dependency.

The Firebase registration package name must match the Android application's configured application ID. Incorrect identifiers can prevent the app from connecting to the intended Firebase configuration.

5. Configuring Firebase Authentication in Android Studio

Step 1: Configure the Google Services Plugin

For a Kotlin DSL project, configure the Google Services plugin in the root Gradle file. Use a compatible version from the official Firebase Android setup guide.

// Project-level build.gradle.kts
plugins {
    id("com.android.application") version "YOUR_AGP_VERSION" apply false
    id("com.google.gms.google-services") version "YOUR_PLUGIN_VERSION" apply false
}

Apply the plugin in the app-level build.gradle.kts file:

plugins {
    id("com.android.application")
    id("org.jetbrains.kotlin.android")
    id("com.google.gms.google-services")
}

Step 2: Add Firebase Authentication Dependency

Use the Firebase Android BoM to manage compatible Firebase library versions.

// app/build.gradle.kts
dependencies {
    implementation(
        platform("com.google.firebase:firebase-bom:YOUR_BOM_VERSION")
    )

    implementation("com.google.firebase:firebase-auth")
}

Replace YOUR_BOM_VERSION with a compatible version from the official Firebase documentation. When using the BoM, do not add a separate version to the Firebase Authentication dependency.

Step 3: Synchronize Gradle

1. Save the Gradle configuration.
2. Click Sync Now in Android Studio.
3. Resolve any dependency or plugin version conflicts.
4. Build the project to verify that the configuration is correct.

Official documentation: Add Firebase to Your Android Project.

6. Enabling Email and Password Sign-In

Adding the SDK does not automatically enable email and password authentication for a Firebase project. The sign-in provider must also be enabled in Firebase Console.

Configuration Steps

1. Open Firebase Console and select your project.
2. Navigate to Authentication.
3. Open the Sign-in method or provider settings.
4. Select Email/Password.
5. Enable the email and password provider.
6. Save the changes.

Once enabled, the Android application can use the Firebase Authentication SDK to create accounts and sign in users using email addresses and passwords.

7. Initializing Firebase Authentication

The application needs a FirebaseAuth instance to perform authentication operations. The instance can be created inside an Activity, ViewModel, or authentication repository, depending on the application's architecture.

Kotlin Example

import com.google.firebase.auth.FirebaseAuth

class AuthRepository {

    private val auth: FirebaseAuth =
        FirebaseAuth.getInstance()

}

Understanding the Code

• FirebaseAuth is the Firebase Authentication class.
• getInstance() returns the default authentication instance.
• The auth variable is used to call registration, login, password recovery, and sign-out methods.
• Keeping authentication operations in a repository can help separate backend operations from the UI.

8. Creating an Email and Password Registration Function

Registration creates a new Firebase Authentication account. The user submits an email address and password, the application validates the input, and Firebase attempts to create the account.

Important Registration Rules

• The email address must be in an acceptable format.
• The password must satisfy the configured Firebase password policy.
• The application should prevent accidental repeated submissions.
• Errors must be handled without exposing sensitive information.
• A successful registration should update the application's authentication state.

Kotlin Registration Example

import com.google.firebase.auth.FirebaseAuth

class AuthRepository {

    private val auth = FirebaseAuth.getInstance()

    fun register(
        email: String,
        password: String,
        onResult: (Boolean, String?) -> Unit
    ) {
        val normalizedEmail = email.trim()

        if (normalizedEmail.isBlank()) {
            onResult(false, "Email is required.")
            return
        }

        if (password.length < 6) {
            onResult(
                false,
                "Password must contain at least 6 characters."
            )
            return
        }

        auth.createUserWithEmailAndPassword(
            normalizedEmail,
            password
        ).addOnCompleteListener { task ->
            if (task.isSuccessful) {
                onResult(true, null)
            } else {
                onResult(
                    false,
                    "Registration could not be completed. Check your details and try again."
                )
            }
        }
    }
}

This example performs basic client-side validation and calls Firebase to create the account. The minimum-length check illustrates the common Firebase default; projects may configure stricter password policies, so the application should match the policy configured for its project.

How the Registration Method Works

1. The method receives an email address and password.
2. It removes unnecessary whitespace from the email address.
3. It checks that the email field is not empty.
4. It performs a basic password-length check.
5. It calls createUserWithEmailAndPassword().
6. Firebase processes the account creation request.
7. The completion listener returns the result to the application.
8. The application displays a suitable message or navigates to the next screen.

Important Security Note

Client-side validation improves usability but is not a replacement for Firebase's authentication checks or server-side access controls. Never store passwords in SharedPreferences, Firestore, local files, or application logs.

9. Designing the Registration Screen

A registration screen collects the information required to create an account. A basic email and password registration form normally includes an email field, password field, a registration button, and a link to the login screen.

Recommended UI Elements

Registration UI Flow

Registration Screen
       |
       v
Enter Email and Password
       |
       v
Tap Register
       |
       v
Validate the Form
       |
       +---- Invalid ----> Display Validation Message
       |
       v
Call Firebase Registration
       |
       +---- Failure ----> Display Error Message
       |
       v
Registration Success
       |
       v
Open the Next Appropriate Screen

After successful registration, Firebase Authentication normally signs in the newly created user automatically. The application should use the resulting authentication state to decide whether to show a welcome screen, request email verification, or display the main application.

10. Creating an Email and Password Login Function

Login authenticates an existing Firebase user. The application submits the email address and password to Firebase, which verifies the credentials and returns the authentication result.

Kotlin Login Example

import com.google.firebase.auth.FirebaseAuth

class LoginRepository {

    private val auth = FirebaseAuth.getInstance()

    fun login(
        email: String,
        password: String,
        onResult: (Boolean, String?) -> Unit
    ) {
        val normalizedEmail = email.trim()

        if (normalizedEmail.isBlank() || password.isBlank()) {
            onResult(
                false,
                "Enter both email and password."
            )
            return
        }

        auth.signInWithEmailAndPassword(
            normalizedEmail,
            password
        ).addOnCompleteListener { task ->
            if (task.isSuccessful) {
                onResult(true, null)
            } else {
                onResult(
                    false,
                    "Login failed. Check your credentials and try again."
                )
            }
        }
    }
}

How the Login Method Works

1. The user enters an email address and password.
2. The application checks that the required fields are filled in.
3. The login method calls signInWithEmailAndPassword().
4. Firebase validates the supplied credentials.
5. The completion listener returns the authentication result.
6. On success, the application updates its UI to reflect the signed-in state.
7. On failure, the application displays a useful but appropriately general error message.

Why Use a General Error Message?

Authentication error messages should avoid unnecessarily revealing whether a particular email address has a registered account. Firebase projects can enable email enumeration protection, which changes the behavior of certain authentication errors. A general login failure message can reduce unnecessary account-discovery risks.

11. Creating a Login Screen

The login screen allows registered users to access their accounts. It should be simple, accessible, and easy to use.

Required UI Components

• Email input field.
• Password input field.
• Login button.
• Forgot Password link.
• Registration link for new users.
• Progress indicator for the authentication request.
• Status text or message area for errors.

Login Screen Processing

User Enters Credentials
          |
          v
Validate Required Fields
          |
          v
Disable Button and Show Progress
          |
          v
Call Firebase Login Method
          |
          v
Wait for Authentication Result
          |
          +---- Success ----> Open Main Screen
          |
          +---- Failure ----> Show Error and Re-enable Button

Important UI Considerations

• Use email-appropriate keyboard settings for the email field.
• Use password input masking by default.
• Disable repeated button taps while a request is running.
• Display clear validation messages next to the relevant fields where possible.
• Restore the button and progress state after a request finishes.
• Do not log passwords or show raw exception details to users.

12. Checking the Current Authentication State

Firebase Authentication maintains a current user when the user is signed in. The application can inspect this user to determine which screen should be displayed.

Example: Checking the Current User

import com.google.firebase.auth.FirebaseAuth

fun isUserLoggedIn(): Boolean {
    val auth = FirebaseAuth.getInstance()
    return auth.currentUser != null
}

If currentUser is not null, Firebase has a currently signed-in user for that authentication instance. This check is useful for selecting the initial screen, but authorization to read or modify data must still be enforced by the backend.

Retrieving User Information

import com.google.firebase.auth.FirebaseAuth

fun printCurrentUserInfo() {
    val user = FirebaseAuth.getInstance().currentUser

    if (user != null) {
        val uid = user.uid
        val email = user.email
        val verified = user.isEmailVerified

        println("User ID: $uid")
        println("Email: $email")
        println("Email verified: $verified")
    }
}

The user's UID is a unique identifier within the Firebase project and is useful for associating the user with their application data. Do not use the UID alone as proof of identity on a separate backend; validate Firebase ID tokens when authenticating requests to your own server.

13. Managing Login Sessions and Navigation

After a successful login, the application usually navigates the user to a home screen. When the app starts again, it can inspect the current authentication state to decide whether to show the login screen or the authenticated area.

Example: Selecting the Initial Screen

import android.content.Intent
import android.os.Bundle
import androidx.appcompat.app.AppCompatActivity
import com.google.firebase.auth.FirebaseAuth

class StartActivity : AppCompatActivity() {

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)

        val currentUser =
            FirebaseAuth.getInstance().currentUser

        val destination = if (currentUser != null) {
            HomeActivity::class.java
        } else {
            LoginActivity::class.java
        }

        startActivity(Intent(this, destination))
        finish()
    }
}

This example assumes that HomeActivity and LoginActivity exist in the project and that AppCompat is configured. A production app should also consider email verification requirements, account-disabled states, and any additional application-specific onboarding checks.

Session Management Best Practices

• Check the current user when determining the initial screen.
• Observe authentication state when the UI must react to sign-in or sign-out changes.
• Do not implement authentication by saving a simple Boolean such as isLoggedIn = true.
• Use Firebase Authentication as the source of truth for the user's Firebase session.
• Apply database security rules to protect private records.
• Clear sensitive screen state when the user signs out.

14. Implementing Logout Functionality

Logout allows a signed-in user to end their current authentication session in the application. Firebase provides the signOut() method for this purpose.

Example: Logout Function

import com.google.firebase.auth.FirebaseAuth

fun logoutUser() {
    FirebaseAuth.getInstance().signOut()
}

Handling Logout in the UI

1. The user taps the Logout button.
2. The application calls signOut().
3. The application clears user-specific UI state and sensitive cached information as appropriate.
4. The user is navigated to the login screen.
5. The application prevents the user from returning to protected screens through the normal navigation flow.

Firebase sign-out does not automatically erase every piece of user data cached or saved by your application. Clear sensitive local application state where required and continue enforcing authorization on backend resources.

15. Implementing Password Reset

Users sometimes forget their passwords. Firebase Authentication provides a password-reset email workflow that lets eligible users request a reset without the application handling or storing their passwords.

Example: Send a Password Reset Email

import com.google.firebase.auth.FirebaseAuth

fun sendPasswordReset(
    email: String,
    onResult: (Boolean, String?) -> Unit
) {
    val normalizedEmail = email.trim()

    if (normalizedEmail.isBlank()) {
        onResult(false, "Enter your email address.")
        return
    }

    FirebaseAuth.getInstance()
        .sendPasswordResetEmail(normalizedEmail)
        .addOnCompleteListener { task ->
            if (task.isSuccessful) {
                onResult(
                    true,
                    "If the request can be processed, follow the instructions sent to your email."
                )
            } else {
                onResult(
                    false,
                    "Unable to process the request. Please try again."
                )
            }
        }
}

The exact user-facing behavior should account for the project's email enumeration protection settings. Avoid exposing unnecessary details about whether an email address belongs to a registered account.

Password Reset Workflow

1. The user opens the Forgot Password screen.
2. The user enters their email address.
3. The application validates the email field.
4. Firebase processes the password-reset request.
5. The user receives email instructions when applicable.
6. The user follows the instructions to reset the password.
7. The user returns to the application and signs in with the updated credentials if needed.

16. Implementing Email Verification

Email verification helps confirm that a user can access the email address associated with an account. It is useful for applications that require a verified email before granting access to particular features.

Example: Send a Verification Email

import com.google.firebase.auth.FirebaseAuth

fun sendVerificationEmail(
    onResult: (Boolean, String?) -> Unit
) {
    val user = FirebaseAuth.getInstance().currentUser

    if (user == null) {
        onResult(false, "Please sign in first.")
        return
    }

    user.sendEmailVerification()
        .addOnCompleteListener { task ->
            if (task.isSuccessful) {
                onResult(
                    true,
                    "Verification instructions have been requested."
                )
            } else {
                onResult(
                    false,
                    "Unable to send verification instructions."
                )
            }
        }
}

Checking Email Verification

import com.google.firebase.auth.FirebaseAuth

fun isEmailVerified(): Boolean {
    return FirebaseAuth.getInstance()
        .currentUser
        ?.isEmailVerified == true
}

After a user opens the verification link, refresh the user record with reload() when appropriate before checking the updated verification state.

Important Verification Considerations

• Decide whether verification is optional or required for the application.
• Explain the verification process clearly to users.
• Provide a way to resend verification instructions where appropriate.
• Refresh the authentication user information after verification.
• Enforce important verified-email requirements in trusted backend logic and security policies where supported.

17. Password Validation and Security

Password validation helps prevent incomplete or weak registration requests. Firebase supports configurable password policies, while the Android client can provide immediate feedback before submitting a registration request.

Common Validation Checks

Example: Basic Form Validation

fun validateRegistration(
    email: String,
    password: String,
    confirmPassword: String
): String? {

    if (email.isBlank()) {
        return "Email is required."
    }

    if (!android.util.Patterns.EMAIL_ADDRESS
            .matcher(email.trim())
            .matches()) {
        return "Enter a valid email address."
    }

    if (password.length < 6) {
        return "Password must contain at least 6 characters."
    }

    if (password != confirmPassword) {
        return "Passwords do not match."
    }

    return null
}

This is a basic example. For production, align client validation with the password policy configured in Firebase Console. Do not silently modify passwords by trimming or changing their characters.

Password Security Best Practices

• Encourage strong, unique passwords.
• Configure an appropriate Firebase password policy.
• Never store passwords in plaintext.
• Never log passwords or include them in analytics events.
• Use secure transport and Firebase SDK methods rather than building a custom password API without a security design.
• Provide password-reset functionality.
• Use generic error messages where revealing account existence could be harmful.

18. Handling Authentication Errors

Authentication requests can fail for several reasons, including invalid input, incorrect credentials, network problems, disabled accounts, and project configuration issues.

Handling Errors in Kotlin

auth.signInWithEmailAndPassword(email, password)
    .addOnCompleteListener { task ->
        if (task.isSuccessful) {
            // Update the authenticated UI state.
        } else {
            // Log diagnostic information safely for developers.
            // Show a suitable, user-friendly message.
        }
    }

For production applications, use structured logging that does not include passwords or other secrets. Map known errors to user-friendly messages when appropriate, while keeping account-discovery protections in mind.

19. Implementing Registration and Login with MVVM

Model-View-ViewModel (MVVM) helps separate the user interface from authentication operations. A repository communicates with Firebase, a ViewModel coordinates UI state, and the Activity, Fragment, or Compose screen displays the state.

Recommended Architecture

Login / Registration Screen
            |
            v
          ViewModel
            |
            v
       AuthRepository
            |
            v
      FirebaseAuth SDK
            |
            v
    Firebase Authentication

Responsibilities of Each Layer

Example: Authentication UI State

sealed interface AuthUiState {
    data object Idle : AuthUiState
    data object Loading : AuthUiState
    data object Success : AuthUiState
    data class Error(val message: String) : AuthUiState
}

A ViewModel can expose this state using StateFlow or another observable mechanism. The UI can then show a progress indicator, display an error, or navigate after success. The same pattern can be used for both registration and login.

Benefits of MVVM for Authentication

• Keeps Firebase operations out of UI code.
• Improves unit testability.
• Provides a consistent way to manage loading and error states.
• Reduces duplicated authentication logic.
• Makes it easier to update the UI in response to authentication changes.

20. Practical Project: Student Registration and Login App

Project objective: Create an Android application in which students can register with an email address and password, log in, view a welcome screen, reset their passwords, and sign out.

Project Features

• Registration screen.
• Login screen.
• Firebase Authentication integration.
• Input validation.
• Loading and error messages.
• Current user information display.
• Password-reset workflow.
• Optional email verification.
• Logout functionality.

Suggested Project Structure

StudentAuthApp/
|
+-- auth/
|   +-- AuthRepository.kt
|   +-- AuthViewModel.kt
|
+-- ui/
|   +-- LoginActivity.kt
|   +-- RegisterActivity.kt
|   +-- HomeActivity.kt
|
+-- MyApplication.kt
+-- AndroidManifest.xml
+-- app/build.gradle.kts
+-- app/google-services.json

Step 1: Configure Firebase

Create a Firebase project, register the Android application, add google-services.json, configure the Google Services plugin, and add the Firebase Authentication dependency.

Step 2: Enable Email/Password

Open Firebase Console, navigate to Authentication, enable Email/Password, and save the provider configuration.

Step 3: Create Registration and Login Forms

Create form fields for email and password. Add registration and login buttons, a Forgot Password link, and navigation between the two screens.

Step 4: Connect the Forms to Firebase

Call createUserWithEmailAndPassword() when the registration form is submitted. Call signInWithEmailAndPassword() when an existing user submits the login form.

Step 5: Display the Authenticated User

val user = FirebaseAuth.getInstance().currentUser

if (user != null) {
    val email = user.email
    val uid = user.uid

    // Display suitable user information.
    // Avoid exposing internal identifiers unnecessarily.
}

Step 6: Add Logout

Add a Logout button to the home screen. Call FirebaseAuth.getInstance().signOut() and navigate back to the login screen.

Step 7: Test the Application

1. Register a new user with a valid email address and password.
2. Verify the user appears in Firebase Console under Authentication.
3. Sign out and sign in with the same credentials.
4. Try submitting empty fields.
5. Test an incorrect password.
6. Test the password-reset workflow.
7. Check the initial screen when a signed-in user reopens the app.
8. Verify that private application data remains protected by backend security rules.

Expected Result

The application should support account creation, sign-in, session-aware navigation, password recovery, and sign-out through Firebase Authentication. Invalid requests should produce appropriate feedback, and sensitive data should not be exposed in logs or local storage.

21. Common Mistakes to Avoid

• Forgetting to enable the Email/Password provider in Firebase Console.
• Placing google-services.json in the wrong directory.
• Using an application ID that does not match the Firebase registration.
• Forgetting to synchronize Gradle after adding dependencies.
• Assuming that successful registration requires a separate login request.
• Failing to check the authentication task's success or failure.
• Allowing users to tap registration or login repeatedly during a request.
• Saving passwords in local files or a cloud database.
• Using client-side navigation as the only access-control mechanism.
• Revealing unnecessary account-existence information through error messages.
• Ignoring password recovery and verification requirements.
• Failing to test authentication behavior after the app restarts.

22. Testing and Debugging Firebase Authentication

Testing should cover successful authentication flows as well as failure cases. The Firebase Authentication emulator can be useful for local development and automated testing.

Testing Checklist

• Valid registration creates an account.
• Duplicate registration is handled appropriately.
• Valid credentials allow login.
• Invalid credentials produce a safe error message.
• Empty fields are rejected before submission.
• Password policy requirements are enforced.
• Password-reset requests are handled correctly.
• Sign-out changes the authentication state.
• App startup responds correctly to the current authentication state.
• Database rules prevent unauthorized access to private records.

Using Firebase Authentication Emulator

The Firebase Local Emulator Suite can provide a local Authentication service for supported testing workflows. It helps developers test registration and login behavior without creating unnecessary test accounts in the production Firebase project.

Keep emulator configuration separate from production configuration and never allow a production build to connect accidentally to a local test service.

23. Best Practices for Email and Password Authentication

• Validate input: Check required fields and provide clear guidance before submitting requests.
• Use Firebase Authentication: Avoid building a custom password storage system without a robust security design.
• Protect passwords: Never log, expose, or store passwords outside the authentication flow.
• Manage sessions correctly: Check the Firebase current user instead of relying on a locally stored login Boolean.
• Handle asynchronous operations: Show loading states and prevent repeated submissions.
• Use safe errors: Avoid exposing unnecessary account information or technical details.
• Offer account recovery: Implement password-reset functionality.
• Consider email verification: Require verification when it is appropriate for the application's use case.
• Secure user data: Use Firestore, Realtime Database, and Storage Security Rules where applicable.
• Keep dependencies compatible: Use the Firebase BoM and compatible Gradle plugin versions.
• Test edge cases: Include network failures, duplicate submissions, invalid input, and authentication errors.
• Respect user privacy: Avoid unnecessary collection or exposure of personal information.

24. Interview Questions and Answers

Q1. What is Firebase Authentication?

Answer: Firebase Authentication is a service that manages user identity and provides authentication methods such as email and password, phone authentication, and supported federated sign-in providers.

Q2. What is email and password registration?

Answer: Registration creates a new user account using an email address and password. In Firebase, the operation is performed using createUserWithEmailAndPassword().

Q3. Which method is used for login?

Answer: The signInWithEmailAndPassword() method authenticates an existing user with email and password credentials.

Q4. What is FirebaseAuth.getInstance()?

Answer: It returns the default Firebase Authentication instance used to perform authentication operations.

Q5. What is the purpose of currentUser?

Answer: The currentUser property provides the currently signed-in Firebase user, or null if there is no current user.

Q6. What happens after successful registration?

Answer: Firebase creates the account and normally signs the newly created user in. The application can then update the UI based on the authentication state.

Q7. How do you implement logout?

Answer: Call FirebaseAuth.getInstance().signOut() and update navigation and user-specific UI state accordingly.

Q8. How does password recovery work?

Answer: The application calls sendPasswordResetEmail(), and Firebase processes a password-reset email request according to the project's configuration.

Q9. What is email verification?

Answer: Email verification helps confirm access to the email address associated with an account. Firebase supports sending verification instructions through the signed-in user's account.

Q10. Why is client-side validation necessary?

Answer: It catches common input mistakes early and improves usability. Firebase and backend security controls remain responsible for authentication and authorization enforcement.

Q11. Why should passwords not be stored in Firestore?

Answer: Firebase Authentication manages password-based credentials. Storing passwords separately introduces unnecessary security risks and should be avoided.

Q12. What is the difference between authentication and authorization?

Answer: Authentication verifies identity, while authorization determines what resources the user may access or modify.

Q13. How can the app remember a signed-in user?

Answer: Firebase Authentication manages the user's authentication state. The application can check currentUser during startup and observe authentication changes when needed.

Q14. What is email enumeration protection?

Answer: It is a security feature that reduces the ability to discover which email addresses are registered through authentication responses. It can affect the specific errors returned by certain operations.

Q15. Why use MVVM with Firebase Authentication?

Answer: MVVM separates UI logic from authentication operations, improves testability, and provides a structured way to manage loading, success, and error states.

25. Practice Exercises

1. Create a Firebase project and connect it to an Android application.
2. Implement an email and password registration form.
3. Implement a login form for existing users.
4. Add validation for empty fields and invalid email formats.
5. Add password confirmation to the registration screen.
6. Display a welcome screen after successful login.
7. Implement logout and test the authentication state after restarting the app.
8. Add a Forgot Password screen.
9. Implement email verification and refresh the user's verification state.
10. Organize authentication operations using a repository and ViewModel.
11. Test invalid credentials and network failures.
12. Protect private Firestore records using authentication-aware Security Rules.

26. Quick Revision Checklist

• Understand registration, login, authentication, and authorization.
• Connect the Android project to Firebase.
• Add the Firebase Authentication SDK.
• Enable Email/Password authentication in Firebase Console.
• Use createUserWithEmailAndPassword() for registration.
• Use signInWithEmailAndPassword() for login.
• Check currentUser to determine the current authentication state.
• Use signOut() to log out.
• Implement password recovery and optional email verification.
• Validate inputs and handle errors safely.
• Never store passwords in application databases or logs.
• Protect private backend data using suitable Security Rules.
• Test success cases, failure cases, and session behavior.

27. Conclusion

Creating email and password registration and login is an essential skill in Android application development. Firebase Authentication simplifies the process by providing account creation, credential verification, session management, password recovery, and email verification capabilities.

A well-designed authentication flow combines Firebase SDK integration with appropriate input validation, clear user feedback, lifecycle-aware session management, and secure backend authorization. Organizing authentication code with repositories and ViewModels also makes an Android application easier to test and maintain.

By completing the practical exercises in these notes, developers can build a foundation for secure authentication in student portals, e-learning applications, shopping apps, and other Android projects.

Useful Learning Resources

• Explore the JustAcademy Android App Development Course
• Register for a JustAcademy Course Demo
• Visit the JustAcademy Homepage
• Open Firebase Console
• Firebase Authentication: Android Setup
• Firebase Password-Based Authentication Guide
• Firebase Authentication Documentation