Login-free trials using localStorage refresh tokens

Question

I just posted on Hacker News about a pattern I implemented for letting users try my side project without signing up first.

The short version: click "Try it now", you're immediately in the dashboard with a working account. No email, no OAuth. A guest secret gets stored in localStorage, and if you come back later we swap it for a fresh JWT. Sign up for real whenever you want and your stuff transfers over.

I wrote up the security considerations (separate JWT keypairs for guests vs real users, hashed secrets, rate limiting, etc.) and the trade-offs I'm accepting (localStorage clearing = lost access, single device only).

Would love to hear if anyone else has done something similar or has thoughts on the approach.

Full post and discussion on HN: https://news.ycombinator.com/item?id=46244742

The project is Spikelog (simple metrics tracking) if you want to poke at the implementation: https://spikelog.com