I have begun to notice some apps and websites (particularly ones made by Apple) which present user login in two steps. In the initial state, only the username/email field is shown. Once you enter a value and press return, then the password field appears.

What is the logic behind hiding this field initially? The field appears too quickly to believe that the app has validated your username/email with a remote service.

  • Are you able to provide a live example, like a URL where you've encountered this? It could just be Apple "think different™" design aesthetics..
    – jonroethke
    Oct 14, 2019 at 6:24
  • @waymobetta no, it's not an Apple thing. The username determines what authentication step has been registered with that name.
    – schroeder
    Oct 14, 2019 at 6:59
  • Ah, ok thanks. Initially was thinking that splitting the user/pass fields up would make it more difficult for automated tools to brute force logins but hadn't encountered a situation like that before.
    – jonroethke
    Oct 14, 2019 at 7:22
  • FWIW, Google Account does this as well
    – Lie Ryan
    Oct 14, 2019 at 11:23


Browse other questions tagged .