Changes I would make to the current functionality Create Models/Dto’s for the ui rather than using domain objects Hash the password rather than storing plain text Split code out of razor pages to keep it cleaner