# Universal Login choices
## New Universal Login (default)
Hosted by Auth0, rendered from your tenant. Customize branding (logo, colors, fonts) in Dashboard > Branding > Universal Login, no code. This is the right default: Auth0 handles bot detection, breached-password warnings, MFA enrollment UI, and security patches.
Identifier-first, organization picker, and passkey options are configured here.
## Classic Universal Login (legacy)
The old Lock.js-based hosted page. Only relevant if you have legacy customizations that the new experience cannot reproduce. New work should not target it.
## Embedded login (Lock.js / auth0.js in your app)
Your page hosts the login form and calls the API directly. Downsides agents underestimate:
- Cross-origin authentication: the login call is cross-origin, which needs Allowed Web Origins and breaks under ITP/cookie blocking in Safari.
- You own the security surface: phishing resistance, bot detection hooks, and password-breach checks that the hosted page gives you for free.
- SSO across your apps does not come for free; the hosted page sets the SSO cookie, your embedded form does not.
Choose embedded only when the product truly needs the form inline and you accept the tradeoffs.
## Customizing without breaking
- Branding > Universal Login: safe, upgrade-proof.
- Custom HTML on the new experience is limited by design; heavy custom login UI belongs in Actions (forms) or a fully custom page only after reading the tradeoffs above.
- Test every branding change in an incognito window; cached sessions hide breakage.
## Checklist
- Default to new Universal Login.
- Embedded only with eyes open about cross-origin auth and ITP.