Can a login form explain that an email address has an invalid format?
Yes. Format validation describes the user's input and does not require disclosing whether the account exists. Keep account lookup failures consistent across valid-looking addresses.
Explore This Question
Search for additional explanations using these tools:
More FAQs in Why should login errors avoid revealing whether an account exists?
Other observable differences, including status behavior or avoidable response-time differences, may still distinguish account states. Review the entire response path rather than only the displayed text.
Use a consistent response explaining that eligible accounts will receive instructions. Provide useful next steps without publicly confirming whether the supplied address belongs to an account.
Still have questions?
Browse all our FAQs or reach out to our support team