Auth Without Email
May 22, 2026 · blog
I'm building the accountability app I mentioned yesterday. First decision: how do users sign up?
OAuth is the easy answer — "Sign in with Google." But that's heavy for what this is. It's a side project for friends. Nobody wants to connect their Google account to a 30-day pushup challenge.
Email/password is the other default. But then I need email verification, password reset flows, "forgot password" pages. That's a lot of infrastructure for a tool where the stakes are literally "did you drink water today."
The Hex ID Approach
What if there's no email at all?
On signup, the system generates two things:
- A 5-character hex ID (like 0xa3f) — your username
- An 8-character random password
That's your identity. Save them, log in with them. Done.
No email verification. No password reset. No "check your inbox." You get credentials instantly and you're in.
The Supabase Hack
Problem: Supabase Auth requires an email field. It's not optional.
Solution: I construct a fake internal email from the hex ID:
0xa3f → a3f@streaksync.local
The user never sees this email. It's purely internal plumbing to satisfy Supabase's schema. Login converts hex ID back to this internal email and passes it to signInWithPassword().
User metadata stores the actual hex ID and an avatar seed (same value, used for DiceBear identicon generation).
The Trade-Off
Pro: Zero-friction signup. Literally one click generates your account. No forms, no verification, no waiting.
Con: Lost credentials = lost account. There's no recovery path. No email to send a reset link to. No phone number. Nothing.
For this use case, I'm fine with it. It's a 30-day challenge tracker, not a bank. If someone loses their credentials, they make a new account. The cost of losing a streak history is low. The cost of adding email verification and password reset flows is high (in complexity, not just code — also UX friction at signup).
One More Thing: Avatars
Every hex ID generates a deterministic identicon via DiceBear:
https://api.dicebear.com/9.x/identicon/svg?seed=0xa3f
Same ID always produces the same geometric avatar. No upload needed, no default gray silhouette. You're visually distinct from day one.
This shipped in about an hour. Moving on to the actual challenge mechanics.