How to review my sign-up page: a checklist you can do by hand

Our recommendation, up front. We make Proxy Mail QA, so we’re not neutral. In this checklist we recommend it for two steps: filling the form with a fresh test account in one click, with Proxy Mail QA for Chrome, and getting the verification code or link without using your own inbox. Most of the checklist needs no product at all, just your browser, a phone and a few free tools we name along the way. Proxy Mail QA doesn’t judge your design, wording, accessibility or speed.

1. Before you start

• Use a staging or local copy, not your live site, so test accounts don’t end up among your real users.
• Use a new email address for every attempt. Signing up twice with the same address tests the “already registered” path, not the sign-up. Your own Gmail with a plus tag works for one or two tries, but the emails mix with your personal mail and some apps refuse plus tags.
• Have the password rules to hand, from the code or the auth service’s settings, so you can check what the page says against what it does.

2. Look before you type

• Is every field needed? Each extra one costs sign-ups. Ask why the phone number or company name is there.
• Does every field have a visible label, not only placeholder text that disappears when you type?
• Are the password rules shown before someone types, not only after they get it wrong?
• Is there a link to sign in for people who already have an account, and to your terms and privacy policy?
• Is it clear what happens next: “We’ll email you a code”?

3. Fill it in once, the way a new customer would

With Proxy Mail QA for Chrome (free, for Chrome, Edge, Brave and Arc):

1. Open your sign-up page, click the extension in the toolbar and choose Turn on for this site. Chrome asks for access to that one site; it runs nowhere else.
2. Click the Proxy Mail QA button in the email field and choose to fill with a new test account. It fills email and confirm email, first and last or full name, username, date of birth and the password and its confirmation, with a password that fits the field’s length and pattern rules. Company, phone and other fields are left for you to type.
3. Submit. The extension asks whether to save the password to the test address, so you can sign in as that account later.
4. When the email arrives, the code appears in a card on the page, with Fill and Copy. A verify link gets Open, in a new tab.

Without the extension, create an address at app.proxymail.qa and copy it in; the code or link shows on its row when the email lands. To try it first, there’s a practice sign-up page.

4. Break it on purpose

Each of these should give a clear error at the field, in words, without clearing what was typed:

• Submit with everything empty.
• An email with no @, or two.
• A confirm email or password that doesn’t match.
• A password that breaks the rules. The extension’s card offers Edge-case password with a list marked “Should be rejected”, made to fit your field’s own limits.
• A name such as O'Brien, José or 李, which should be accepted. The card’s Edge-case first name has more, including HTML such as <b>Jane</b>, which should be shown as plain text.
• An address that’s already registered. Decide whether the page should say so, or say “Check your email” either way so nobody can find out who has an account.
• Double-click the submit button. You should get one account and one email.

Check the errors are announced, not only coloured red, and that the cursor goes to the first one.

5. Read the email

Open the test address in the app and read the whole email once:

• Is the sender name your product, and the subject clear?
• Does every link go to the site you’re testing? A link to localhost on a staging site is flagged on the address’s row. How to fix it.
• If it says how long the code or link lasts, is that true?
• Does it read well on a phone?

Then use the code or link and check you end up signed in.

6. After sign-up

• Sign out and sign in again. On a sign-in form the extension offers your test accounts, the ones used on that site first, and fills the email with its saved password.
• Reset the password, and check the old one stops working.
• Note what you found on the test address, so it stays with that account for whoever looks next.

7. On a phone, and without a mouse

• Open the page on a real phone, or in your browser’s device mode. Does the email field bring up the keyboard with @? Is anything cut off or hidden behind the keyboard?
• Fill the whole form with the keyboard alone: Tab through it, tick boxes with Space, submit with Enter.
• Run Lighthouse (built into Chrome DevTools) and axe DevTools or WAVE for accessibility problems, and try the form with a screen reader such as VoiceOver or NVDA.
• Check fields have autocomplete attributes (email, new-password, given-name), so password managers and browsers fill them properly.

What Proxy Mail QA doesn’t cover

• How the page looks, reads and converts. That’s your judgement, or your users’.
• Accessibility, speed and SEO: use the tools in step 7.
• SMS codes and social sign-in: it receives email only.
• Fields only your app has, such as “How did you hear about us?”: you type those yourself.

Once the page passes by hand, you can have an agent repeat these checks on every change: see AI sign-up page review.