I’m Mason Payne. This is my blog about authentication and building SpartanAuth — an auth system I’m designing to stay simple enough that people actually ship it.
I use SpartanAuth in several of my own apps. Here you’ll find practical notes on passkeys, login UX, security tradeoffs, and the unglamorous parts of putting auth in production.
The login widget library is open source. If something here is useful, I’d love for you to try the product or say hello.
For a long time this blog was me writing about auth while the product was still finding its legs. That chapter is over.
SpartanAuth is live. Not a slide deck. Not a private prototype I only demo on good days. It is running in real applications — including several of my own — and other people are shipping with it too.
I spend a lot of time thinking about where open source helps a software business — and where companies use the label while extracting more than they return. Building SpartanAuth has made that less abstract for me. I care about doing right by developers, and I also need a business that can sustain the work through Masonite Studios.
One quick boundary, because accuracy matters: SpartanAuth the service is not open source. What is open source is the login widget library, and I am proud of that. The rest of this post is about industry patterns I see, not a claim that my whole stack is OSS.
When I started SpartanAuth, I had a simple obsession: authentication should be easy to do correctly. Complexity is where security bugs and abandoned sign-ins both hide. Today I want to talk about the login widget.
TLDR: usability, branding, and making the secure path the easy path.
Businesses lose real money when people cannot sign in. “About a third of online purchases are abandoned at checkout because consumers cannot remember their passwords,” from a study conducted jointly by MasterCard and the University of Oxford (source). That is a big reason I care about helping apps move away from relying on passwords.
Have you ever switched phone providers? Maybe you walked into a store, found that shiny new phone you’ve always wanted (or just learned that you always wanted). The store employees are super happy with your choice. They get your information, you give them your phone number, and the next thing you know you have a new phone and a new provider. Easy, right?
Now imagine someone else — who is not you — decides they want a new phone too. Only they want access to some of your accounts. They pretend they are you. They tell the store your phone number. The store activates your phone number on their device. They can now receive text messages intended for you. That trick is called SIM swapping. There are other ways attackers get SMS messages too: forwarding numbers, account-port abuse, or social engineering someone at the carrier.
I keep coming back to a blunt fact: passwords are expensive. Not just annoying — expensive in support time, abandoned checkouts, and breach cleanup.
It has been observed that many companies’ support teams are overloaded with password reset calls. According to research from Forrester, the average cost for a single password reset is about $70. Another report by Gartner estimates that 20% to 50% of all help desk calls are for password resets.
On top of all this, according to a report from IBM, 20% of all breaches came from compromised credentials.
I’m Mason Payne, and this is my blog about building SpartanAuth.
I started these posts while getting the product off the ground. The short version of where things stand now: SpartanAuth is a real auth service I use in several of my own applications. I’m still writing here when I learn something worth sharing — passwords, passkeys, login UX, and the tradeoffs you hit when auth has to work for real users.