Excellent walk through of best practices for sign in forms - something we have to do each time.

Particular highlights for me are: the show password functionality (which also includes CSS and JS to show how it can be done), aria support and reports backing recommendations (particularly for mobile UI).

Source: web.dev