Email/password signup in Firebase - Commands & Configuration

Introduction

Creating an email and password signup lets users create accounts securely. This solves the problem of identifying users and managing access without complicated setups.

When you want users to register with their email and a password to access your app.

When you need a simple way to manage user accounts without social logins.

When you want to protect parts of your app so only signed-up users can use them.

When you want to send password reset emails to users who forget their password.

When you want to track user activity linked to their email identity.

Config File - firebase.json

firebase.json

{
  "hosting": {
    "public": "public",
    "ignore": ["firebase.json", "**/.*", "**/node_modules/**"],
    "rewrites": [
      {
        "source": "/**",
        "destination": "/index.html"
      }
    ]
  }
}

This file configures Firebase hosting.

hosting: Sets up where your app files are served from.

Note: Authentication sign-in methods are configured in the Firebase Console, not in firebase.json.

Commands

Log in to your Firebase account to allow CLI commands to access your projects.

Terminal

firebase login

Expected Output

✔  Success! Logged in as [e-mail]

Initialize Firebase Authentication in your project to enable email/password signup.

Terminal

firebase init auth

Expected Output

=== Authentication Setup ===

✔  Authentication enabled

✔  Email/Password sign-in method enabled

Firebase Authentication has been initialized.

Deploy the hosting configuration to Firebase so your app is served.

Terminal

firebase deploy --only hosting

Expected Output

=== Deploying to 'your-project-id' ===



✔  hosting: Successfully deployed



Project Console: https://console.firebase.google.com/project/your-project-id/overview



✔  Deploy complete!

→

--only - Deploy only the specified Firebase feature, here hosting.

Import users with hashed passwords to Firebase Authentication (example for advanced use).

Terminal

firebase auth:import users.json --hash-algo=SCRYPT --hash-key=base64Key --salt-separator=base64Salt --rounds=8 --mem-cost=14

Expected Output

✔  Successfully imported users.

List all users registered in Firebase Authentication to verify the new signup.

Terminal

firebase auth:list

Expected Output

Users:

- [e-mail] (UID: abc123def456)

Key Concept

If you remember nothing else from this pattern, remember: enabling and deploying email/password authentication in Firebase lets users securely create accounts with just their email and a password.

Common Mistakes

Not enabling the email/password sign-in method in Firebase console.

Users cannot sign up or log in without this method enabled.

Always enable email/password sign-in in Firebase Authentication settings before deploying.

Using weak or simple passwords during signup.

Weak passwords reduce security and can lead to account compromise.

Use strong passwords with letters, numbers, and symbols for user accounts.

Not deploying hosting changes after updating config.

Changes won't take effect until deployed, so signup won't work as expected.

Run 'firebase deploy --only hosting' after any hosting config changes.

Summary

Use 'firebase init auth' to enable email/password signup in your Firebase project.

Enable email/password sign-in method in Firebase Console under Authentication > Sign-in method.

Deploy hosting settings with 'firebase deploy --only hosting' to serve your app.

Create and verify users with Firebase Authentication SDK or Admin SDK; CLI commands for user creation are not standard.

Use 'firebase auth:list' to list users.

Practice

1. What does the Firebase method createUserWithEmailAndPassword do?

easy

A. It registers a new user with an email and password.

B. It logs in an existing user with email and password.

C. It deletes a user account from Firebase.

D. It updates the user's email address.

Solution

1. Step 1: Understand the method purpose

   The method createUserWithEmailAndPassword is designed to create a new user account using email and password credentials.

2. Step 2: Differentiate from other user methods

   Logging in uses a different method, and deleting or updating users require other Firebase functions.

3. Final Answer:

   It registers a new user with an email and password. -> Option A

4. Quick Check:

   createUserWithEmailAndPassword = register user [OK]

Hint: Remember 'create' means new user signup, not login [OK]

Common Mistakes:

• Confusing signup with login method
• Thinking it updates user info
• Assuming it deletes users

2. Which of the following is the correct syntax to create a user with email and password in Firebase (JavaScript)?

easy

A. firebase.auth().signUpWithEmail(email, password)

B. firebase.createUser(email, password)

C. firebase.auth().createUserWithEmailAndPassword(email, password)

D. firebase.auth().registerUser(email, password)

Solution

1. Step 1: Recall Firebase Auth syntax

   The correct method to create a user is called on the auth object: createUserWithEmailAndPassword(email, password).

2. Step 2: Verify method names

   Other options use incorrect method names that do not exist in Firebase Auth API.

3. Final Answer:

   firebase.auth().createUserWithEmailAndPassword(email, password) -> Option C

4. Quick Check:

   Correct Firebase signup syntax = firebase.auth().createUserWithEmailAndPassword(email, password) [OK]

Hint: Look for 'auth' and exact method name [OK]

Common Mistakes:

• Using non-existent method names
• Omitting 'auth()' before method
• Mixing signup and login method names

3. What will be the output if the following code runs successfully?

firebase.auth().createUserWithEmailAndPassword('[e-mail]', 'pass123')
  .then(userCredential => console.log(userCredential.user.email))
  .catch(error => console.log(error.message));

medium

A. pass123

B. [e-mail]

C. undefined

D. Error message printed

Solution

1. Step 1: Understand promise resolution

   On success, then receives a userCredential object containing the user info.

2. Step 2: Access user email

   The code logs userCredential.user.email, which is the email used to create the account.

3. Final Answer:

   [e-mail] -> Option B

4. Quick Check:

   Success logs user email = [e-mail] [OK]

Hint: Success logs user email property [OK]

Common Mistakes:

• Expecting password to be logged
• Confusing error catch with success
• Assuming undefined output

4. Identify the error in this Firebase signup code snippet:

firebase.auth().createUserWithEmailAndPassword(email, password)
  .then(userCredential => console.log('User created'))
  .catch(error => console.log(error));

medium

A. Missing import of Firebase Auth module

B. Incorrect method name used

C. Using console.log inside catch is invalid

D. No error handling for empty email or password

Solution

1. Step 1: Check method and syntax

   The method name and syntax are correct; console.log in catch is valid.

2. Step 2: Consider input validation

   The code does not check if email or password are empty before calling Firebase, which can cause errors.

3. Final Answer:

   No error handling for empty email or password -> Option D

4. Quick Check:

   Input validation missing = No error handling for empty email or password [OK]

Hint: Always validate inputs before signup call [OK]

Common Mistakes:

• Assuming console.log in catch is wrong
• Thinking method name is incorrect
• Ignoring input validation importance

5. You want to create a signup form that prevents users from registering with weak passwords. Which approach best applies Firebase email/password signup with password strength validation?

hard

A. Check password strength in frontend before calling createUserWithEmailAndPassword and show errors if weak.

B. Call createUserWithEmailAndPassword directly and rely on Firebase to reject weak passwords.

C. Skip password checks and allow any password; fix later in user profile settings.

D. Use Firebase Admin SDK on client to validate password strength.

Solution

1. Step 1: Understand Firebase password rules

   Firebase requires passwords to be at least 6 characters but does not enforce complex strength rules.

2. Step 2: Implement frontend validation

   To improve security, validate password strength on the client side before calling Firebase signup to give immediate feedback.

3. Step 3: Avoid insecure or incorrect methods

   Relying only on Firebase or skipping checks reduces security; Admin SDK is for backend, not client.

4. Final Answer:

   Check password strength in frontend before calling createUserWithEmailAndPassword and show errors if weak. -> Option A

5. Quick Check:

   Frontend validation + Firebase signup = Check password strength in frontend before calling createUserWithEmailAndPassword and show errors if weak. [OK]

Hint: Validate password strength before signup call [OK]

Common Mistakes:

• Relying only on Firebase for password strength
• Using Admin SDK on client side
• Ignoring password validation completely