Deepak Gupta

The Login Quality Scorecard

Twenty checks decide most of what a customer feels at your login screen. You can run all of them this week with a test account, a new phone, and an hour of your time.

Score one point per check. Run the scorecard on day 1 of the plan in Chapter 11, then again on day 90. The change between the two scores is the simplest progress report you can give leadership.

The 20-point scorecard

Passwords (Chapter 3)

No composition rules (upper, lower, number, symbol)
No scheduled password expiry; reset only on compromise
New passwords screened against breached and common lists
Paste and password manager autofill work on every field
No security questions or password hints

Passkeys (Chapter 4)

Passkey sign-in available on web and mobile
Passkey autofill enabled on the identifier field
Passkey offered after sign-in and after password reset
Passkey shown as a primary option, not hidden in settings

MFA and sessions (Chapter 6)

Users can mark a device as trusted for 30 days or more
Step-up is tied to named sensitive actions, not every visit
No code requested after a passkey sign-in
Push approvals use number matching, or push is retired
SMS is a fallback, never the only second factor

Login screen and checkout (Chapter 7)

Guest path for purchases and trials; account offered afterward
Identifier-first flow with one field to start
Error messages do not reveal whether an email exists
CAPTCHA appears only on risk signals

Recovery and trust

Users are notified of new devices, new factors, and recovery events
Support agents cannot bypass account factors without a verified process

Tip

Score only what a real customer gets today, in production. A feature behind a flag, or live for 10% of users, scores zero until it reaches everyone.

How to read your score

The bands below are my working benchmark, not an industry standard. They come from the pattern I saw over and over: brands with a handful of gaps feel fine, and brands with many gaps lose customers quietly.

Score	What it means	What to do first
17 to 20	A strong login experience	Protect it: track the monthly metrics and watch for regressions
12 to 16	Workable, with visible friction	Fix the lowest-scoring section first, usually passkeys or MFA
8 to 11	Login is likely costing you customers today	Run phase 1 of Chapter 11 in full before adding anything new
0 to 7	Login is a revenue and security problem	Start with passwords and recovery; they carry the most risk

Look at the section scores as well as the total. A perfect password section with zero passkey points means you modernized the old model instead of replacing it. A weak recovery section undermines everything else, because attackers go where the controls are weakest.

The three-person test, as a script

Dashboards tell you what happened. Watching three people sign in tells you why. This 20-minute exercise usually finds more friction than a quarter of dashboards.

Setup

Recruit three people outside your team. Mix technical comfort levels; one should be someone who rarely uses your product category.
Use a new phone, or a factory-reset one, with no saved passwords or passkeys for your site.
Prepare a test account for each person, plus one real purchase or key action they can complete.
Assign one observer with a stopwatch and the results table below. The observer does not help.

Steps

Sign in. Ask the person to sign in to their test account. Start the clock when they open the app or page. Stop it when they reach the signed-in home screen.
Complete a key action. Ask them to buy something or complete the action that matters most to your business. Time it from start to confirmation.
Change their email address. Time it from opening settings to the confirmed change. This is your step-up test.
Sign out and sign in again. If a passkey was offered, note whether they accepted it and how the second sign-in compares.

What to time and count

Seconds per step, from start to finish
Every prompt shown: code, CAPTCHA, MFA, enrollment offer, consent banner
Every error message, copied word for word
Every moment the person hesitates for more than five seconds or asks a question
Whether the email change asked for fresh proof of identity

Results template

Person	Step	Time (seconds)	Prompts shown	Errors	Hesitations	Notes
1	Sign in
1	Key action
1	Change email
1	Sign in again
2	Sign in
2	Key action
2	Change email
2	Sign in again
3	Sign in
3	Key action
3	Change email
3	Sign in again

Two patterns deserve immediate fixes. Any prompt during a low-risk step, such as a code request on a known device, is friction in the wrong place. An email change that asks for nothing beyond the current session is the opposite problem: security missing where it matters.

Metrics to track every month

Each metric below has a definition and a formula, so two teams computing it get the same number. Pick one time window (calendar month) and one source of truth (your funnel dashboard), and keep both fixed.

Metric	What it tells you	Direction
Sign-in success rate (first attempt)	How often a real user gets in without help	Up; passkeys reach 93% in the FIDO Passkey Index
Median time to sign in	Friction users feel	Down
MFA prompts per active user per month	Whether your risk engine is working	Down
Passkey share of successful sign-ins	Real adoption, not enrollment	Up
Password resets per 1,000 users	Hidden churn and support cost	Down
Login-related support tickets	Direct cost of friction	Down
Abandonment at login or signup	Revenue lost at the door	Down
Account takeover rate	Whether removing friction cost you safety	Flat or down

Definitions and formulas

Sign-in success rate (first attempt) = sign-in attempts that succeed on the first try ÷ all sign-in attempts. Count an attempt as failed if the user retries, resets, or abandons.
Median time to sign in = the median of (signed-in timestamp minus sign-in start timestamp) across successful sign-ins. Use the median, not the mean, so a few slow sessions do not hide the typical experience.
MFA prompts per active user = MFA challenges shown ÷ monthly active users.
Passkey share of successful sign-ins = passkey sign-ins ÷ all successful sign-ins. This is the adoption number. Enrollment rate (users with a passkey ÷ active users) is useful, but it flatters you.
Password resets per 1,000 users = (password reset requests ÷ monthly active users) × 1,000.
Login-related support tickets = tickets tagged login, MFA, or recovery in the month. Tag consistently, or this number is noise.
Abandonment at login or signup = sessions that reach the login or signup step but do not complete it ÷ sessions that reach the step.
Account takeover rate = confirmed account takeovers ÷ monthly active users, usually reported per 100,000 users.

The last metric is the guardrail. If every other metric improves and account takeovers stay flat or fall, you have proven the point this ebook is built on. I wrote about the wider set of identity metrics worth watching in CIAM observability metrics.

Closing: security and experience were never opposites

Bad login design was hurting both. Composition rules made passwords weaker. Prompts on every visit trained users to approve without reading. Recovery flows built for convenience became the front door for attackers.

The fixes in this ebook point the same way. Passkeys are faster and phishing-resistant. Step-up at sensitive moments protects what matters without taxing every visit. A recovery process with friction in the right places keeps attackers out without locking customers out.

So here is my question for you: which of these numbers does your team see today, and who owns them?

Key takeaways

Run the 20-point scorecard on day 1 and day 90; score only what every customer gets in production.
Read section scores, not just the total; weak recovery undermines everything else.
Run the three-person test with a stopwatch and an observer who does not help.
Define every metric with a formula, and keep passkey share of sign-ins separate from enrollment.
Account takeover is the guardrail: flat or down while friction falls proves the case.

Tip

Do this next week:

Score your login against the 20 checks and share the result with product and security.
Recruit three people and run the three-person test on a new phone.
Add the eight monthly metrics to one dashboard, using the formulas above.

About the author

Deepak Gupta founded LoginRadius in 2013 and scaled it to serve more than 1 billion users, helping define what is now called customer identity and access management (CIAM). In 2024 he started GrackerAI, which does Generative Engine Optimization for B2B cybersecurity vendors: making sure a company shows up in answers from ChatGPT, Perplexity, Claude and Google's AI features.

He holds 5 granted patents spanning DDoS defense, IoT authentication, searchable encryption and AI fake-news detection, and has written 6 books. As a former CISO he has been through SOC 2, ISO, GDPR and CCPA audits. He runs two practitioner communities, Start with Identity and LogicBalls, and maintains the CIAM Compass vendor directory. More at guptadeepak.com/about.

Sources

Standards and government guidance

Passkey and authentication data

User experience and commerce

Vendors (pricing and documentation, checked November 2026)

All sources accessed November 2026.