A sample website with a complete, working email + password authentication system built on Val Town.

Visit the live site

Create an account (or log in with the test user sam@example.com / supersecret1), and you'll land on a members-only dashboard.

Capability	Implementation
Server	Hono + JSX (index.tsx)
Users & sessions	SQLite, scoped to this val (lib/db.ts)
Password hashing	PBKDF2 (100k iterations, per-user 16-byte salt) via WebCrypto (lib/security.ts)
Sessions	Random 256-bit token stored in the DB, delivered as an HttpOnly, Secure, SameSite=Lax cookie signed with HMAC-SHA256
Route protection	/dashboard requires a valid session; otherwise redirects to /login

• GET / — homepage
• GET/POST /signup — create an account (auto-logs you in)
• GET/POST /login — sign in
• POST /logout — destroy the session
• GET /dashboard — protected page for authenticated users

• Passwords are never stored in plaintext; each is hashed with a unique random salt.
• Login returns the same error for an unknown email and a wrong password, preventing user enumeration.
• Session cookies are signed so they can't be forged without SESSION_SECRET, and sessions can be revoked server-side on logout.

• SESSION_SECRET — secret used to sign session cookies. Set it to a long random string before going to production. It's already configured on this val.

• index.tsx — HTTP entrypoint (routes + views)
• lib/security.ts — password hashing and cookie signing
• lib/db.ts — SQLite schema and queries