Creating Email and Password Registration and Login in iOS

Course: iOS App Development

Topic: Creating Email and Password Registration and Login

Course Link: iOS App Development Training

Demo Link: Register for a Course Demo

Website: JustAcademy

1. Introduction

Email and password authentication is a common feature in iOS applications. It allows users to create an account, sign in with existing credentials, access protected features, and sign out when they finish using the application.

A registration and login system typically includes a user interface, input validation, an authentication service, secure session handling, and clear responses to authentication errors. The app must also communicate securely with an authentication provider or backend server.

In a production application, an iOS app should not create accounts or verify passwords only through local checks. A trusted authentication backend, such as Firebase Authentication or a custom server, must verify credentials and manage account identity. Client-side validation improves usability but does not replace server-side security.

2. Learning Objectives

• Understand email and password authentication.
• Differentiate registration, login, logout, and password reset.
• Create registration and login forms using SwiftUI.
• Validate email addresses and passwords.
• Connect an iOS app to an authentication provider.
• Handle loading states and authentication errors.
• Understand authentication tokens and user sessions.
• Use Keychain-related features and Password AutoFill appropriately.
• Protect credentials and avoid common security mistakes.
• Test authentication workflows in an iOS application.

3. Understanding Authentication

Authentication is the process of verifying a user's identity. Authorization determines what an authenticated user is permitted to access.

4. Typical Authentication Workflow

New User
   |
   v
Registration Form
   |
   v
Validate Input
   |
   v
Send Request to Authentication Provider
   |
   v
Create Account and Receive Result
   |
   v
Optional Email Verification
   |
   v
Authenticated or Verification-Pending State

Existing User
   |
   v
Login Form
   |
   v
Validate Input
   |
   v
Authenticate with Provider
   |
   v
Receive Authenticated Session
   |
   v
Open Protected Application Content

The exact workflow depends on the provider and application requirements. For example, an application may require email verification before allowing access to certain features.

5. Registration Form Requirements

A registration form collects the information needed to create an account. For a basic email and password flow, the main fields are:

• Email: The email address associated with the account.
• Password: The new account password.
• Confirm password: An optional field used to catch typing mistakes.
• Register button: Submits valid information to the authentication service.
• Login link: Lets existing users switch to the login screen.

Keep the form simple. Do not ask for unnecessary personal information during registration. Additional details can be collected later if they are required for a clear product purpose.

6. Login Form Requirements

The login form allows an existing user to authenticate using their registered email address and password.

• Email input field.
• Password input field.
• Login or Sign In button.
• Forgot Password link.
• Link to the registration screen.
• Loading indicator while authentication is in progress.
• Clear, accessible error messages when login fails.

The login button should not submit repeated requests while an earlier request is still running. Disable it during the request and restore it when the operation finishes.

7. Creating the SwiftUI Registration Form

SwiftUI provides controls such as TextField, SecureField, Button, and ProgressView to create authentication interfaces.

import SwiftUI

struct RegistrationView: View {
    @State private var email = ""
    @State private var password = ""
    @State private var confirmPassword = ""
    @State private var errorMessage: String?
    @State private var isSubmitting = false

    var body: some View {
        NavigationStack {
            Form {
                Section("Create Account") {
                    TextField("Email address", text: $email)
                        .keyboardType(.emailAddress)
                        .textContentType(.emailAddress)
                        .textInputAutocapitalization(.never)
                        .autocorrectionDisabled()

                    SecureField("Password", text: $password)
                        .textContentType(.newPassword)

                    SecureField("Confirm password", text: $confirmPassword)
                        .textContentType(.newPassword)

                    if let errorMessage {
                        Text(errorMessage)
                            .foregroundStyle(.red)
                    }

                    Button {
                        Task {
                            await register()
                        }
                    } label: {
                        if isSubmitting {
                            ProgressView()
                        } else {
                            Text("Create Account")
                        }
                    }
                    .disabled(isSubmitting)
                }
            }
            .navigationTitle("Register")
        }
    }

    private func register() async {
        errorMessage = nil

        guard isValidEmail(email) else {
            errorMessage = "Enter a valid email address."
            return
        }

        guard password.count >= 8 else {
            errorMessage = "Password must contain at least 8 characters."
            return
        }

        guard password == confirmPassword else {
            errorMessage = "Passwords do not match."
            return
        }

        isSubmitting = true
        defer { isSubmitting = false }

        // Call the authentication service here.
        // Do not create an account using local validation alone.
    }

    private func isValidEmail(_ value: String) -> Bool {
        let trimmed = value.trimmingCharacters(
            in: .whitespacesAndNewlines
        )
        return trimmed.contains("@") &&
            trimmed.contains(".") &&
            !trimmed.contains(" ")
    }
}

This is a user-interface and validation example. Its email check is deliberately simple and is not a complete email validation algorithm. A real application must call an authentication provider to create the account and handle the provider's response.

8. Creating the SwiftUI Login Form

The login form uses an email field and a secure password field. Authentication is delegated to a service rather than implemented directly inside the view.

import SwiftUI

struct LoginView: View {
    @State private var email = ""
    @State private var password = ""
    @State private var errorMessage: String?
    @State private var isSubmitting = false

    let onLogin: (String, String) async throws -> Void

    var body: some View {
        NavigationStack {
            Form {
                Section("Sign In") {
                    TextField("Email address", text: $email)
                        .keyboardType(.emailAddress)
                        .textContentType(.emailAddress)
                        .textInputAutocapitalization(.never)
                        .autocorrectionDisabled()

                    SecureField("Password", text: $password)
                        .textContentType(.password)

                    if let errorMessage {
                        Text(errorMessage)
                            .foregroundStyle(.red)
                    }

                    Button("Login") {
                        Task {
                            await login()
                        }
                    }
                    .disabled(isSubmitting)
                }
            }
            .navigationTitle("Login")
        }
    }

    private func login() async {
        errorMessage = nil

        guard !email.trimmingCharacters(
            in: .whitespacesAndNewlines
        ).isEmpty, !password.isEmpty else {
            errorMessage = "Enter your email and password."
            return
        }

        isSubmitting = true
        defer { isSubmitting = false }

        do {
            try await onLogin(email, password)
        } catch {
            errorMessage = "Unable to sign in. Check your details and try again."
        }
    }
}

The onLogin closure is injected by the parent view or application dependency container. This keeps the login screen independent of a specific authentication provider and makes it easier to test.

9. Choosing an Authentication Provider

There are several ways to implement authentication. Select a provider based on your application's backend, security requirements, user-management needs, and operational capabilities.

For learning purposes, Firebase Authentication is a convenient option because it provides built-in email/password account creation and sign-in operations. The following sections show how it can be integrated.

10. Setting Up Firebase Authentication

1. Create a project in the Firebase console.
2. Add an iOS application using the correct bundle identifier.
3. Download the Firebase configuration file and add it to the Xcode project as instructed by Firebase.
4. Add the Firebase Apple platforms SDK using Swift Package Manager.
5. Include the Firebase Authentication product in the app target.
6. Initialize Firebase when the application launches.
7. Enable the Email/Password sign-in provider in the Firebase console.
8. Test account creation and login using a development environment.

Follow the provider's current installation instructions because SDK setup steps can change between releases.

Initialize Firebase

import SwiftUI
import FirebaseCore

@main
struct MyApp: App {
    init() {
        FirebaseApp.configure()
    }

    var body: some Scene {
        WindowGroup {
            ContentView()
        }
    }
}

This example assumes Firebase has been added correctly to the project and its configuration file is available to the app.

11. Implementing Registration with Firebase Authentication

Firebase Authentication provides an asynchronous API for creating an account using an email address and password.

import FirebaseAuth

struct FirebaseAuthService {
    func register(
        email: String,
        password: String
    ) async throws {
        let normalizedEmail = email
            .trimmingCharacters(in: .whitespacesAndNewlines)

        _ = try await Auth.auth().createUser(
            withEmail: normalizedEmail,
            password: password
        )
    }
}

After registration, the app should handle the result according to its account policy. For example, it may prompt the user to verify their email address before granting access to sensitive features.

Calling Registration from the View

private let authService = FirebaseAuthService()

private func createAccount() async {
    errorMessage = nil
    isSubmitting = true
    defer { isSubmitting = false }

    do {
        try await authService.register(
            email: email,
            password: password
        )
        // Update navigation or account state after success.
    } catch {
        errorMessage = "Account creation failed. Please try again."
    }
}

In a complete implementation, define authService as an injected dependency instead of creating provider dependencies inside a view. Handle known provider error codes carefully and present useful messages without exposing internal technical details.

12. Implementing Login with Firebase Authentication

The sign-in method verifies the submitted credentials through Firebase Authentication and returns the result of the authentication operation.

import FirebaseAuth

extension FirebaseAuthService {
    func login(
        email: String,
        password: String
    ) async throws {
        let normalizedEmail = email
            .trimmingCharacters(in: .whitespacesAndNewlines)

        _ = try await Auth.auth().signIn(
            withEmail: normalizedEmail,
            password: password
        )
    }
}

The UI should react to the result rather than assuming that a request succeeded. On success, update the application's authentication state and show the appropriate screen. On failure, preserve the user's ability to correct their input or retry.

13. Managing Authentication State

Authentication state tells the app whether a user is signed in and which screens or actions are available. A common approach is to maintain a central authentication state model that observes the provider's current user.

import FirebaseAuth
import Combine

@MainActor
final class AuthState: ObservableObject {
    @Published private(set) var isSignedIn = false

    private var listener: AuthStateDidChangeListenerHandle?

    init() {
        listener = Auth.auth().addStateDidChangeListener {
            [weak self] _, user in
            self?.isSignedIn = user != nil
        }
    }

    deinit {
        if let listener {
            Auth.auth().removeStateDidChangeListener(listener)
        }
    }
}

This simplified example tracks whether a Firebase user exists. A production app may also need loading, verification-pending, session-expired, and error states. The app should not treat a Boolean flag by itself as proof that a user is authorized to access a backend resource.

Example Authentication Flow

if authState.isSignedIn {
    // Show the authenticated part of the app.
} else {
    // Show registration and login screens.
}

Protected server resources must still verify the access token or session on the backend. Hiding a screen in the UI is not an authorization control by itself.

14. Password Validation and Requirements

Password validation should balance usability and security. The client can check basic requirements before submitting a request, but the authentication provider or backend must enforce the actual account policy.

• Reject an empty password.
• Use a password policy appropriate to the service and its security requirements.
• Allow strong, unique passwords and avoid arbitrary rules that unnecessarily restrict password managers.
• Do not silently trim or modify a password.
• Do not log passwords or include them in analytics events.
• Use confirmation fields only when they provide a useful error-prevention benefit.

A minimum of eight characters is used in some simple teaching examples, but it should not be treated as a universal security standard. Follow current security guidance and the provider's supported password policy. Encourage long, unique passwords and support Password AutoFill.

15. Email Validation

Client-side email validation catches obvious mistakes, such as a blank value or missing parts of an address. It should not be used to decide whether an email address genuinely exists or belongs to the user.

Example Basic Validation

func isBasicEmailFormatValid(_ email: String) -> Bool {
    let value = email.trimmingCharacters(
        in: .whitespacesAndNewlines
    )

    guard !value.isEmpty,
          !value.contains(" "),
          let atIndex = value.firstIndex(of: "@") else {
        return false
    }

    let domain = value[email.index(after: atIndex)...]

    return !domain.isEmpty && domain.contains(".")
}

This is a basic educational check, not a complete implementation of email syntax rules. The authentication service remains responsible for accepting or rejecting the address and may require verification before the account is fully usable.

16. Handling Authentication Errors

Authentication can fail for multiple reasons. The application should distinguish recoverable input problems from network failures or account restrictions when the provider exposes reliable error codes.

Avoid exposing internal stack traces, database details, or sensitive account information in user-facing messages. Error handling should also avoid unnecessarily revealing whether a particular email address has an account.

17. Forgot Password and Email Verification

17.1 Forgot Password

A password recovery feature lets users regain access without revealing or retrieving their existing password. A typical flow asks for an email address and requests a password reset message from the authentication provider.

import FirebaseAuth

func sendPasswordReset(to email: String) async throws {
    let normalizedEmail = email
        .trimmingCharacters(in: .whitespacesAndNewlines)

    try await Auth.auth().sendPasswordReset(
        withEmail: normalizedEmail
    )
}

Display a neutral confirmation message where appropriate so the interface does not reveal whether the email address belongs to an existing account. The provider controls the actual delivery and reset process.

17.2 Email Verification

Email verification confirms that a user can access the email address associated with the account. It can help reduce invalid accounts and support account recovery.

import FirebaseAuth

func sendVerificationEmail() async throws {
    guard let user = Auth.auth().currentUser else {
        return
    }

    try await user.sendEmailVerification()
}

After the user follows the verification link, refresh or re-fetch the authentication user's status as required by the provider before relying on the verification result. Backend authorization rules should enforce verification requirements for protected actions.

18. Secure Password and Session Handling

Authentication is security-sensitive. A well-designed login form is not enough; the app and backend must protect credentials and session information throughout their lifecycle.

• Use HTTPS: Send authentication requests through secure transport.
• Never store plain-text passwords: Password verification and password hashing belong on the trusted authentication server.
• Do not embed secrets in the app: API secrets and privileged credentials cannot be protected reliably inside a distributed client application.
• Use secure session management: Follow the authentication provider's token lifecycle, expiration, refresh, and revocation procedures.
• Use Keychain when appropriate: Store sensitive client-side credentials or tokens according to their security requirements.
• Support secure password entry: Use secure text fields and appropriate content types.
• Avoid logging sensitive data: Never log passwords, full tokens, or recovery codes.
• Apply rate limiting: Configure the backend or provider to reduce automated abuse.
• Enforce authorization on the server: Validate credentials and permissions for every protected operation.

Do not save the user's password in UserDefaults, an ordinary JSON file, or an unprotected database. Prefer the provider's supported session management and Keychain-based secure storage when direct credential storage is necessary. Read Apple's Keychain documentation.

19. Password AutoFill and Keyboard Experience

iOS supports Password AutoFill, which helps users create, save, and enter credentials securely. Appropriate text content types help the system understand whether a field is for a new password or an existing password.

Use labels that explain each field, provide accessible error messages, and make controls large enough to interact with comfortably. Test the form with Password AutoFill, VoiceOver, Dynamic Type, and different device sizes.

Reference: Apple Password AutoFill Documentation.

20. Logging Out Safely

Logging out should invalidate the local authenticated state and use the provider's sign-out mechanism. The app should then return the user to an appropriate unauthenticated screen.

import FirebaseAuth

func signOutUser() throws {
    try Auth.auth().signOut()
}

After sign-out, clear any user-specific in-memory state and caches that should not remain available to the next user of the device. For custom authentication systems, follow the server's token revocation or session invalidation policy as well.

21. Common Mistakes to Avoid

• Checking credentials only on the device without an authentication backend.
• Storing passwords in UserDefaults or plain-text files.
• Logging passwords, tokens, or other sensitive authentication details.
• Showing technical stack traces directly to users.
• Allowing repeated registration or login submissions while a request is in progress.
• Assuming that a successful login automatically grants every permission.
• Forgetting password reset, email verification, or session expiration flows.
• Using simplistic client-side email validation as the final authority.
• Ignoring accessibility and Password AutoFill support.
• Failing to test network interruptions and authentication provider errors.

22. Practical Project: Authentication Module

Build a small iOS application with registration, login, password recovery, and a protected home screen.

Project Requirements

1. Create registration and login screens using SwiftUI.
2. Validate required input before submitting a request.
3. Connect Firebase Authentication or a trusted custom backend.
4. Display loading indicators during authentication operations.
5. Handle registration, login, and network errors.
6. Add password reset and email verification if supported by the selected provider.
7. Maintain authentication state across screen changes.
8. Provide a logout option.
9. Use secure session management and avoid storing passwords locally.
10. Test success, failure, and recovery scenarios.

Suggested Project Structure

AuthenticationApp/
|-- App/
|   |-- AuthenticationApp.swift
|   |-- AppDependencies.swift
|-- Features/
|   |-- Authentication/
|   |   |-- RegistrationView.swift
|   |   |-- LoginView.swift
|   |   |-- ForgotPasswordView.swift
|   |   |-- AuthenticationViewModel.swift
|   |-- Home/
|       |-- HomeView.swift
|-- Services/
|   |-- AuthService.swift
|   |-- FirebaseAuthService.swift
|-- Models/
|   |-- AuthState.swift
|-- Tests/
    |-- AuthValidationTests.swift
    |-- AuthenticationViewModelTests.swift

Expected Outcome

The completed application should allow a new user to register, an existing user to sign in, and an authenticated user to access protected content. It should also provide clear recovery and error flows while keeping authentication implementation details out of the user interface.

23. Testing Checklist

• Registration succeeds with valid input and a functioning provider.
• Empty email and password values are handled correctly.
• Invalid email input receives helpful feedback.
• Password confirmation mismatch is detected when confirmation is used.
• Duplicate account registration is handled appropriately.
• Incorrect login credentials do not open the protected area.
• Network failures restore the form to an interactive state.
• Password reset requests are handled correctly.
• Email verification status is refreshed when needed.
• Logout updates authentication state and clears relevant user data.
• Passwords and tokens do not appear in logs.
• VoiceOver and Password AutoFill work with the forms.

24. Interview Questions and Answers

Q1. What is authentication?

Answer: Authentication verifies a user's identity, usually through credentials or another trusted identity mechanism.

Q2. What is the difference between registration and login?

Answer: Registration creates a new account, while login verifies credentials for an existing account.

Q3. Why is client-side validation insufficient?

Answer: Client-side checks improve usability, but they can be bypassed. The trusted backend or authentication provider must enforce account and security rules.

Q4. Why should passwords not be stored in UserDefaults?

Answer: UserDefaults is not designed as secure credential storage. Apps should use provider-managed sessions and appropriate secure storage mechanisms such as Keychain when needed.

Q5. What is Firebase Authentication?

Answer: Firebase Authentication is a service that provides account registration, sign-in, and other authentication methods for supported platforms.

Q6. What is email verification?

Answer: It is a process that confirms the user can access the email address associated with an account.

Q7. How does password reset work?

Answer: The application asks the authentication provider to send a reset message. The user follows the provider's secure process to establish a new password.

Q8. What is the purpose of Keychain?

Answer: Keychain provides protected storage for sensitive information such as credentials and tokens that an app needs to retain securely.

Q9. Why should login requests use HTTPS?

Answer: HTTPS protects data in transit against interception and tampering when correctly configured.

Q10. What should happen after a successful login?

Answer: The app should update its authentication state, handle the returned session according to provider guidance, and present the appropriate authorized content.

Q11. Why is logout important?

Answer: Logout ends the user's active app session according to the provider's mechanism and helps prevent access to private content from the signed-out interface.

Q12. How can authentication screens be tested?

Answer: Test input validation and state transitions with unit tests, use mocked authentication services for deterministic failure scenarios, and use UI tests for critical registration and login journeys.

25. Quick Revision Checklist

• Registration creates an account; login authenticates an existing account.
• Use SwiftUI text fields and secure password fields appropriately.
• Validate input before sending authentication requests.
• Use a trusted provider or backend for credential verification.
• Handle errors, loading indicators, and retry actions.
• Support password recovery and email verification when required.
• Use Password AutoFill and appropriate content types.
• Never store plain-text passwords or log sensitive credentials.
• Use secure session handling and enforce authorization on the server.
• Test registration, login, logout, failure, and recovery flows.

26. Conclusion

Email and password registration and login are foundational features in many iOS applications. A reliable implementation combines a clear SwiftUI interface, sensible input validation, a trusted authentication provider, secure session management, and predictable application state.

Keep authentication logic in a dedicated service, handle failures gracefully, support password recovery and verification where appropriate, and protect credentials throughout their lifecycle. With these practices, developers can build authentication flows that are maintainable, accessible, and safer for users.

Additional Learning Resources

• Explore the iOS App Development Course
• Register for a Course Demo
• Visit JustAcademy
• Firebase Authentication for Apple Platforms
• Apple Keychain Services Documentation
• Apple Password AutoFill Documentation