How to fix auth/user-not-found in Firebase

First, check if the user account actually exists:

1. Go to your [Firebase Console](https://console.firebase.google.com)

2. Navigate to Authentication > Users
3. Search for the email address the user is trying to sign in with
4. If the user is not listed, they have not created an account yet

If the user exists but sign-in is still failing, the issue may be with your code implementation.

Add specific error handling to distinguish "user-not-found" from other authentication errors:

Web/JavaScript:

import { signInWithEmailAndPassword, getAuth } from "firebase/auth";

const auth = getAuth();
signInWithEmailAndPassword(auth, email, password)
  .catch((error) => {
    if (error.code === "auth/user-not-found") {
      console.log("User account does not exist. Please sign up.");
      // Redirect to registration page
    } else if (error.code === "auth/wrong-password") {
      console.log("Incorrect password.");
    } else {
      console.log("Login error:", error.message);
    }
  });

Admin SDK (Node.js):

const admin = require("firebase-admin");

admin.auth().getUserByEmail("[email protected]")
  .then(userRecord => {
    console.log("User found:", userRecord.uid);
  })
  .catch(error => {
    if (error.code === "auth/user-not-found") {
      console.log("User does not exist in Firebase Authentication.");
    }
  });

Help users who don't have an account by offering an easy registration path:

1. Add a "Don't have an account? Sign up" link in your login form
2. Redirect to your registration page when the error is caught
3. Allow users to create a new account with email and password
4. Send a welcome email after successful registration

This improves user experience and reduces sign-in failures.

Implement client-side email validation to catch common mistakes:

// Basic email format validation
const isValidEmail = (email) => {
  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  return emailRegex.test(email);
};

if (!isValidEmail(email)) {
  console.log("Please enter a valid email address.");
  return;
}

// Show email format feedback to users
const emailInput = document.getElementById("email");
emailInput.addEventListener("blur", () => {
  if (!isValidEmail(emailInput.value)) {
    emailInput.classList.add("error");
  }
});

Also consider suggesting common email typos when sign-in fails.

Firebase includes email enumeration protection by default. This means the "auth/user-not-found" error message is intentionally vague to prevent attackers from determining which emails are registered in your system.

If you're implementing additional security:

1. Log authentication attempts server-side for audit trails
2. Monitor for repeated failed login attempts from the same IP
3. Implement rate limiting to prevent brute force attacks
4. Use Admin SDK server-side operations for sensitive checks instead of exposing them client-side