diff --git a/tests/ui/login.spec.ts b/tests/ui/login.spec.ts
new file mode 100644
index 0000000..a5a01dd
--- /dev/null
+++ b/tests/ui/login.spec.ts
@@ -0,0 +1,41 @@
+// The sign-in form (#393). Every other test signs in with the token link, so the form itself --
+// its fields, its error, where it goes after -- was never run (login.ts at 0% in the coverage).
+// The suite's page starts signed out here: this file has no beforeEach presenting the token.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { root } from './global-setup.ts';
+import { expect, test } from './coverage.ts';
+
+// The first start made `admin` and wrote its password beside the config, as production's does.
+const password = () => fs.readFileSync(path.join(root, 'config', 'admin-password'), 'utf8').trim();
+
+test('signed out, the app sends you to the sign-in form', async ({ page }) => {
+  await page.goto('/');
+  await expect(page).toHaveURL(/\/login$/);
+  await expect(page.locator('#f')).toBeVisible();
+  await expect(page.locator('#name')).toBeFocused();
+});
+
+test('a wrong password says so and leaves you signed out', async ({ page }) => {
+  await page.goto('/login');
+  await page.locator('#name').fill('admin');
+  await page.locator('#pw').fill('not the password');
+  await page.getByRole('button', { name: /sign in/i }).click();
+  // The server's own words, not the form's fallback.
+  await expect(page.locator('#msg')).toHaveText('wrong name or password');
+  await expect(page).toHaveURL(/\/login$/);
+  expect((await page.request.get('/api/me')).status()).toBe(401);
+});
+
+test('the right name and password sign you in and open the app as you', async ({ page }) => {
+  await page.goto('/login');
+  await page.locator('#name').fill('admin');
+  await page.locator('#pw').fill(password());
+  // Enter submits, as a sign-in form should.
+  await page.locator('#pw').press('Enter');
+  await expect(page).toHaveURL(/\/$/);
+  await expect(page.locator('#feedlist')).toBeVisible();
+  await expect(page.locator('#who')).toContainText('admin');
+  expect((await (await page.request.get('/api/me')).json()).name).toBe('admin');
+});