Until this week, the first thing Skudo asked a new person for was a username. Not an email address, not a password: a username, on a screen with nothing else on it, before they had invested anything at all.

It was the worst possible thing to put first, and it took us a while to see why.

The step with the most ways to fail

Look at what a username field can do to you. It can be taken. It can be too short. It can contain a character we do not allow. It can be reserved. Each of those is a rejection, and each rejection arrives before the person has any reason to persist.

Compare that with an email address. Almost everyone types theirs correctly the first time, because they have typed it ten thousand times. The failure rate of the two fields is not close.

We had put the fragile step first and the reliable one second.

It existed for a feature almost nobody uses

The honest reason the username was there is that Skudo supports aliases on your own subdomain: anything@yourname.skudo.org. That is a genuinely useful feature for a small number of people who want an unlimited supply of addresses without creating each one.

For everyone else it is invisible. They create aliases from the dashboard, the address is generated, and their username never appears anywhere they look.

So we were asking every single person to make a permanent decision, on the first screen, to enable something most of them would never use. That is not a trade, it is a toll.

What it looks like now

We generate one. It comes out readable, something like quietotter47, and it sits on the last step next to a button to shuffle it and a button to write your own. If you care, it costs you one click. If you do not, it costs you nothing and you never think about it again.

The signup is now three steps instead of four: address, code, password. The address goes first because it is the thing the product is actually about, and because proving it belongs to you is the only verification that matters.

The part we did not change

We still ask for a password, and we still will.

It is tempting to go passwordless. Passkeys are better in almost every way, and our login screen already puts them first. But in Skudo the password does a second job: it protects the private key that encrypts your forwarded mail, through a key derivation function that runs in your browser. Remove the password and that key has nothing to be protected by.

So the password stays, and what changed is what we ask around it. One field, a reveal button, no confirmation field, and advice that tells you what is actually wrong with what you typed rather than demanding a capital letter.

A note on that advice

The password guidance follows NIST SP 800-63B revision 4, finalised in July 2025. That revision did something unusual for a standards body: it removed rules. Composition requirements, the "one uppercase, one number, one symbol" ritual, are explicitly gone. They were removed because they do not work. Told to add a symbol, almost everyone adds an exclamation mark at the end, and an attacker knows that.

What replaced them is length, and screening against passwords already known to be breached. So we do not ask for symbols. We look at what you typed, and if it is a keyboard walk, a year, a run of digits, or the Word123! shape those old rules taught a generation of people, we say so in those words.

Telling someone their password is weak is not advice. Telling them it contains qwerty is.