diff --git a/src/main/resources/static/home.html b/src/main/resources/static/home.html
new file mode 100644
index 0000000..635856a
--- /dev/null
+++ b/src/main/resources/static/home.html
@@ -0,0 +1,24 @@
+<!-- src/main/resources/static/home.html -->
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head><meta charset="UTF-8"><title>首页</title></head>
+<body>
+<h1>欢迎访问受保护页面</h1>
+<div id="userInfo"></div>
+<script>
+    (async ()=>{
+        const token = localStorage.getItem('token');
+        if (!token) return window.location.href='login.html';
+        const res = await fetch('/api/me', {
+            headers: { 'token': token }
+        });
+        const json = await res.json();
+        if (json.code!==0) {
+            return window.location.href='login.html';
+        }
+        document.getElementById('userInfo')
+            .innerText = '当前用户：' + json.data.username;
+    })();
+</script>
+</body>
+</html>
diff --git a/src/main/resources/static/login.html b/src/main/resources/static/login.html
new file mode 100644
index 0000000..993941d
--- /dev/null
+++ b/src/main/resources/static/login.html
@@ -0,0 +1,38 @@
+<!-- src/main/resources/static/login.html -->
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <title>登录</title>
+</head>
+<body>
+<h2>用户登录</h2>
+<form id="loginForm">
+    <label>身份证号：</label>
+    <input type="number" name="identificationNumber" required>
+    <label>密码：</label>
+    <input type="password" name="password" required>
+    <button type="submit">登录</button>
+</form>
+<script>
+    document.getElementById('loginForm')
+        .addEventListener('submit', async e => {
+            e.preventDefault();
+            const form = new URLSearchParams(new FormData(e.target));
+            const res = await fetch('/login', {
+                method: 'POST',
+                body: form
+            });
+            const json = await res.json();
+            if (res.ok && json.code === 0) {
+                // 保存 token
+                localStorage.setItem('token', json.data);
+                // 跳转到受保护的页面
+                window.location.href = 'home.html';
+            } else {
+                alert(json.msg);
+            }
+        });
+</script>
+</body>
+</html>
diff --git a/src/main/resources/static/register.html b/src/main/resources/static/register.html
new file mode 100644
index 0000000..1e43e90
--- /dev/null
+++ b/src/main/resources/static/register.html
@@ -0,0 +1,54 @@
+<!-- src/main/resources/static/register.html -->
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <title>注册</title>
+</head>
+<body>
+<h2>用户注册</h2>
+<form id="regForm">
+    <label>用户名：</label>
+    <input type="text" name="username" required>
+    <label>邮箱：</label>
+    <input type="email" name="email" required>
+    <button type="button" id="sendCode">发送验证码</button>
+    <label>邮箱验证码：</label>
+    <input type="text" name="verificationCode" required>
+    <label>密码：</label>
+    <input type="password" name="password" required>
+    <label>身份证号（8 位数字）：</label>
+    <input type="number" name="identificationNumber" required>
+    <label>邀请码：</label>
+    <input type="text" name="inviteCode" required>
+    <button type="submit">注册</button>
+</form>
+<script>
+    document.getElementById('sendCode')
+        .addEventListener('click', async () => {
+            const form = new URLSearchParams();
+            form.set('email', document.querySelector('[name=email]').value);
+            form.set('inviteCode', document.querySelector('[name=inviteCode]').value);
+            const res = await fetch('/sendVerification', {
+                method: 'POST',
+                body: form
+            });
+            alert((await res.json()).msg);
+        });
+    document.getElementById('regForm')
+        .addEventListener('submit', async e => {
+            e.preventDefault();
+            const form = new URLSearchParams(new FormData(e.target));
+            const res = await fetch('/register', {
+                method: 'POST',
+                body: form
+            });
+            const json = await res.json();
+            alert(json.msg);
+            if (res.ok && json.code===0) {
+                window.location.href='login.html';
+            }
+        });
+</script>
+</body>
+</html>