diff --git a/docs/android-app.md b/docs/android-app.md
index 4789728..1dde13d 100644
--- a/docs/android-app.md
+++ b/docs/android-app.md
@@ -130,7 +130,9 @@ If your instance sits behind a reverse proxy configured to require a login
 (HTTP Basic authentication — for example an **Access List** in Nginx Proxy
 Manager), the app asks for it the first time it connects, from version 1.3:
 
-> **Sign in** — *mc-webui.example.com asks for a username and password.*
+<p align="center">
+  <img src="../images/android-wrapper-signin.png" width="330" alt="mc-webui Android app - sign-in dialog for a server that requires a password">
+</p>
 
 Enter the username and password your proxy expects and tap **SIGN IN**. They are
 remembered per server address, so later launches go straight in. Get them wrong
diff --git a/docs/https-setup.md b/docs/https-setup.md
index 725ba6f..1023048 100644
--- a/docs/https-setup.md
+++ b/docs/https-setup.md
@@ -74,7 +74,11 @@ You should see `mc-webui` and `mc-webui-proxy`.
 
 Open `http://<your-server>:81`. On first run you get a short setup form where you create
 your own administrator account — name, email and password. There is no default login to
-change afterwards.
+change afterwards. Every later visit lands on the sign-in page:
+
+<p align="center">
+  <img src="../images/npm-00-login-page.png" width="360" alt="Nginx Proxy Manager - sign-in page">
+</p>
 
 Keep this panel on the local network and **do not forward port 81 through your router**:
 it can route traffic anywhere inside your network, and it is served over plain HTTP.
@@ -345,7 +349,11 @@ and the Access Lists page counts the hosts using it:
 </p>
 
 Every path is covered — the interface, the API, and the websocket — so there is no way in
-that skips the prompt.
+that skips the prompt. From now on the browser asks before mc-webui loads:
+
+<p align="center">
+  <img src="../images/npm-08-browser-login.png" width="330" alt="Browser sign-in prompt in front of mc-webui">
+</p>
 
 > **Check the Android app after turning this on.** [App version 1.3](android-app.md) or
 > newer handles the prompt; older versions do not and will show the proxy's bare "401
diff --git a/images/android-wrapper-signin.png b/images/android-wrapper-signin.png
new file mode 100644
index 0000000..a54dfab
Binary files /dev/null and b/images/android-wrapper-signin.png differ
diff --git a/images/npm-00-login-page.png b/images/npm-00-login-page.png
new file mode 100644
index 0000000..bb54be0
Binary files /dev/null and b/images/npm-00-login-page.png differ
diff --git a/images/npm-08-browser-login.png b/images/npm-08-browser-login.png
new file mode 100644
index 0000000..20b2aa9
Binary files /dev/null and b/images/npm-08-browser-login.png differ