YOUR BRIEF
What to work through
Work through login and authentication as a spoken system design interview. Start by clarifying the scope, sketch a working design and explain the trade-offs behind your choices.
- Sign up and sign in with email and password
- Stay signed in across visits, and sign out of one device or all of them
- Reset a forgotten password by email
- Turn on a second factor, and be asked for it on risky sign-ins
- Slow down password guessing and attacks with leaked passwords
BEFORE YOU START
Constraints to discuss
- Passwords are kept only as slow salted hashes, never in a form that can be reversed
- Session ids carry at least 64 bits of entropy (OWASP)
- Sign-in stays available, and an outage never weakens the checks
- At most 100 failed attempts in a row on one factor before it is disabled (NIST)
- Sessions end on the server after an idle limit and an absolute limit
Need a starting point?
Watch for these common gaps as you prepare:
- Storing passwords with a fast hash, or encrypted so they can be reversed
- Long-lived tokens with no way to end them early
- A reset link that never expires or works more than once
- Different answers for known and unknown emails at sign-in or reset
- Locking an account after a few failures, so anyone can lock out any user
- Keeping old sessions alive after a password reset
Why this question is in the collection
These sources connect the problem to company interview reports or preparation guides. They do not guarantee what a company will ask you.
- Stripe: Aced lists "Design a user login system" as a system design question tied to two Stripe and Visa interviews, last asked about five months before October 2026.
- Visa: The same Aced question page tags Visa beside Stripe, for software and forward deployed engineers.
- Netflix: Aced’s Netflix guide lists, among questions reported by candidates: a subscriber clicks forgot password, design everything behind it.
- Bloomberg: PracHub lists a Bloomberg onsite report from September 2025: a sign-in app with sessions or tokens, password storage, optional multi-factor and protection against takeover.
- MathWorks: PracHub lists a MathWorks onsite report from February 2026: email and password sign-in for a cloud product, sessions, credential stuffing and ten times the traffic.
- Okta: PracHub lists an Okta onsite report from October 2026: one sign-in across two sites on separate domains, then many sites and third-party tools.
- Bridge: PracHub lists a Bridge technical screen from January 2026: email and password sign-up and sign-in, secure password storage and login state.