User Signup Process 101

Over the 18 months we have operated the website gottakeepup.com and in the process we have learned lots about the good, band and ugly of the user signup process. In this blog article I will share some of the lessons learned, and some of the things we have done (or plan to do) to improve our process.

User or Email - I was surprised at how little research & writing was out there as to which of these was the "right" answer, I guess it depends on your application. If you have an application that requires a valid email to work (as we do), I think its a no brainier to require an email. I also think most users dont forget their current email, but they may forget their id, especially if they have a common name like John Smith, maybe thier id could be "jsmith" or "johnsmith" or some other variant. Remembering their email is probably easier. The downside to email is they change and get old, so I may have a login that is no longer my current email, in this case you want to be able to let users change their primary login.

Email Validation - you should do some checking on the emails the users enter, this is one thing we need to improve. If I had a nickel for every time someone typed gmail.com or gmall.co or something like that for their email then I would be rich! The problem is if you get too tricky you may start filtering out valid users. One Idea we plan to try is to put together a list of the top 100 email providers, and do some regex matching, if the email suffix is within 1 or 2 chars of one of those, give the user some feedback that says, did you mean gmail.com instead of gmail.co, but you still probably want to let them if they insist. There are plenty of domain country codes you might not think exist, but probably do.

Password Hash or Encrypt - There are 2 primary ways to store your users password in your database, one is to hash and the other is to encrypt. Use the hash method when your site needs to be very secure, you are handling money etc. This way even internal people in your organization cannot get to passwords. The downside is you cant send their user their own password, so you have to go through a reset process, which is much more painful than resending the password.

Passwords -  This hugely depends on your application, in general many software developers choose security over usability. There has to be a balance, especially if there is no money used in the application, let the users create reasonably simple easy to remember passwords. No matter what make them case insensitive otherwise you deal with the "capslock" nightmare.

To CAPTCHA or not to CAPTCHA

If you are not going to validate emails, then you probably need a CAPTCHA on your signup process. If you are going to validate emails, then its probably redundant. CAPTCH has some real usability issues, so avoid it if you can.

Validate Emails

If you are going to be allowing the users to post public items or send out emails to others, then you need to do this. Otherwise you will have a real problem with spammers on your hand. If you do decide to validate emails, we recommend you do it right away, we used to let users into our system and have them come back and validate later, this created a management nightmare for us, and we found many less validated their emails.  If you force them up front, you will lose some users right away, but the ones that go through you can be reasonably sure they are valid and you can communicate with them. You would be surprised about the number of people that put bogus info in if you don't do this. If you do require validation, a couple suggestions:

• Ask the User to add your email to their address book before you send the validation email.
• Make sure you have setup your mail server properly and are on all the appropriate white lists.
• Create a resend link that allows them to resend emails, sometimes they had a spam problem and fixed it, or deleted the email accidentally, you need to allow the user to trigger a resend of the activation email.
• Show what email they used in the screen that is prompting them to activate, lots of times they will realize they made a typo then, if possible give them a link to go fix their email.
• Take the user to the activation screen if they come back and login later, but make sure there is plenty of info as to how/why they got here and what to do about it, lots of times we have seen screens that are blank but say "Please activate", most users dont remember what to do.

OpenID
OpenID is s super cool idea, if you can support it, then do it, allow your users to either create a local account or an OpenID one. Consider using ID Selector which goes along way to making OpenID more usable. Consider adding some friendly documentation that explains what OpenId is, but also may just say , login using your existing accounts at Yahoo, Google and AOL or someting like that. Most users dont understand what OpenID is, but they do understand that they have a AOL account.

Collecting Information
Users are hypersensitive to sites that want information, no one wants to give out information but everyone wants all their services to be free. But... for you to make money using online advertising, you need to know stuff about these people, at a minimum you need to know they are at least 13 years old or you can get in trouble with the law. Since you must ask, we say get their birth year at least, if possible have them enter their full birth date. You also need to know generally where they live, we say if you are doing online advertising, then you "Must" require postal code. If you dont, you will be kicking yourself later and have to do some data normalization. So the minimum are birth year and postal code, but you should also collect (optionally) other info that will help the user get the most of your application.

Remember Me

Putting a checkbox below the user when signing  up/signing in will keep the user logged in for some period of time. We like the way yahoo has done this with their email:

Keep me signed in for 2 weeks unless I sign out. [Uncheck if on a shared computer]

Depending on your application, make it a longer time period.

Referral Codes

Usually you create your wonderful application and then you realize that you have to market it to get users to come. You then realize you need some way to track where users come from and in some cases make payments from it. Google Analytics is great help here, but not perfect. I recommend you add a simple column to your user table that has a referral code, when users come to any page on your site you check for this "referral code" on the url and drop a cookie. If/When the user signs up, you use the cookie to add the referral code to the users table. Then you can write simple reports to figure out where all your new users are coming from.

Comments

[Bill C.]

Hey Joel,
Great post. One additional issue with using e-mail addresses instead of user names is that they make it very difficult for folks who routinely use different (or generated) e-mail addresses. For example, I use sneakemail.com to generate disposable e-mail addresses as I wander around the web. (Yahoo mail supports a similar function.) That way, if a site sells (or otherwise gives away) my e-mail address, I can identify the offending site and kill the address.

[Joel Nylund]

Bill, Great point, I wonder how widespread this practice is beyond us nerds, regardless its a good argument in favor of not using email.