diff --git a/internal/server/handler_auth.go b/internal/server/handler_auth.go
index 2740000..77949e4 100644
--- a/internal/server/handler_auth.go
+++ b/internal/server/handler_auth.go
@@ -5,7 +5,7 @@ import (
 	"log"
 	"net/http"
 
-	"github.com/rjnemo/auth/internal/auth"
+	"github.com/rjnemo/auth/internal/service/auth"
 )
 
 const (
diff --git a/internal/server/handler_dashboard.go b/internal/server/handler_dashboard.go
index 50190b5..c3e4b4f 100644
--- a/internal/server/handler_dashboard.go
+++ b/internal/server/handler_dashboard.go
@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/rjnemo/auth/internal/auth"
+	"github.com/rjnemo/auth/internal/service/auth"
 )
 
 const dashboardTimeDisplayLayout = "02 Jan 2006 15:04 MST"
diff --git a/internal/server/server.go b/internal/server/server.go
index 7f291d9..48616a4 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -7,7 +7,7 @@ import (
 	"html/template"
 	"time"
 
-	"github.com/rjnemo/auth/internal/auth"
+	"github.com/rjnemo/auth/internal/service/auth"
 	"github.com/rjnemo/auth/web"
 )
 
diff --git a/internal/auth/password.go b/internal/service/auth/password.go
similarity index 100%
rename from internal/auth/password.go
rename to internal/service/auth/password.go
diff --git a/internal/auth/service.go b/internal/service/auth/service.go
similarity index 89%
rename from internal/auth/service.go
rename to internal/service/auth/service.go
index cff9e22..9ea111c 100644
--- a/internal/auth/service.go
+++ b/internal/service/auth/service.go
@@ -2,8 +2,6 @@ package auth
 
 import (
 	"context"
-	"crypto/rand"
-	"encoding/base64"
 	"errors"
 	"fmt"
 	"time"
@@ -96,12 +94,3 @@ func (s *Service) Register(ctx context.Context, email UserEmail, password string
 
 	return &user, nil
 }
-
-// TODO: could be UUID. return a dedicated type
-func generateUserID() (string, error) {
-	buf := make([]byte, userIDByteLength)
-	if _, err := rand.Read(buf); err != nil {
-		return "", err
-	}
-	return base64.RawURLEncoding.EncodeToString(buf), nil
-}
diff --git a/internal/service/auth/store.go b/internal/service/auth/store.go
new file mode 100644
index 0000000..3f26d4e
--- /dev/null
+++ b/internal/service/auth/store.go
@@ -0,0 +1,18 @@
+package auth
+
+import (
+	"context"
+	"errors"
+)
+
+// ErrUserNotFound signals no user exists for the provided lookup criteria.
+var (
+	ErrUserNotFound  = errors.New("auth: user not found")
+	ErrEmailRequired = errors.New("auth: email required")
+)
+
+// UserStore defines persistence expectations for user lookups.
+type UserStore interface {
+	FindByEmail(ctx context.Context, email UserEmail) (*User, error)
+	Create(ctx context.Context, user User) error
+}
diff --git a/internal/auth/store.go b/internal/service/auth/store_memory.go
similarity index 71%
rename from internal/auth/store.go
rename to internal/service/auth/store_memory.go
index 17209bd..66162b7 100644
--- a/internal/auth/store.go
+++ b/internal/service/auth/store_memory.go
@@ -2,22 +2,9 @@ package auth
 
 import (
 	"context"
-	"errors"
 	"sync"
 )
 
-// ErrUserNotFound signals no user exists for the provided lookup criteria.
-var (
-	ErrUserNotFound  = errors.New("auth: user not found")
-	ErrEmailRequired = errors.New("auth: email required")
-)
-
-// UserStore defines persistence expectations for user lookups.
-type UserStore interface {
-	FindByEmail(ctx context.Context, email UserEmail) (*User, error)
-	Create(ctx context.Context, user User) error
-}
-
 // MemoryStore is an in-memory implementation of UserStore for development and tests.
 type MemoryStore struct {
 	mu    sync.RWMutex
diff --git a/internal/auth/user.go b/internal/service/auth/user.go
similarity index 78%
rename from internal/auth/user.go
rename to internal/service/auth/user.go
index 86dbb95..05042b0 100644
--- a/internal/auth/user.go
+++ b/internal/service/auth/user.go
@@ -1,6 +1,8 @@
 package auth
 
 import (
+	"crypto/rand"
+	"encoding/base64"
 	"errors"
 	"strings"
 	"time"
@@ -45,3 +47,12 @@ func (e UserEmail) String() string {
 func (e UserEmail) IsZero() bool {
 	return e == ""
 }
+
+// TODO: could be UUID. return a dedicated type
+func generateUserID() (string, error) {
+	buf := make([]byte, userIDByteLength)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(buf), nil
+}