Excellent walk through of best practices for sign in forms - something we have to do each time.
Particular highlights for me are: the show password functionality (which also includes CSS and JS to show how it can be done), aria support and reports backing recommendations (particularly for mobile UI).
Source: web.dev