Login Without the Friction: A Brand Guide to Balancing Security and Experience

Half of American adults have walked away from an online purchase because they forgot a password or could not log in. A HostingAdvice survey of more than 1,000 Americans put the figure at 51%, and at 72% for Gen Z. This guide is the short version of a free ebook, Login Without Friction: The 2026 Passwordless Playbook for Brands, which you can read in the browser with no signup. It gives product, security and growth leaders four guidelines, a friction map and a 20-check scorecard for a login that is both safer and easier.

Key takeaways

• Friction should follow risk, not routine. A known phone sees no prompt; a new device changing the payout account sees a strong one.
• Password complexity and rotation rules are now out of step with NIST. SP 800-63B Revision 4 says verifiers shall not impose composition rules or scheduled resets.
• Passkeys win on both axes. The 2026 FIDO Passkey Index reports a 93% sign-in success rate for passkeys against 78% for passwords and traditional MFA.
• Repeated MFA prompts weaken security. They train users to approve without reading, which is exactly what push-bombing attackers exploit.
• Measure login like a funnel. Track first-attempt success, prompts per user and account takeovers together.

Login is a revenue problem wearing a security badge

A forgotten password rarely shows up in a funnel report, because the user never got far enough to be counted.

Baymard Institute sees the same leak from the checkout side. In its usability testing, returning customers who had to reset a forgotten password produced an 18.75% average checkout abandonment rate on large sites such as Amazon and ASOS. The same research found 82% of benchmarked e-commerce sites had very complex password requirements.

I founded a CIAM platform in 2013 and scaled it to more than 1 billion users. The pattern I saw over and over: brands treated login as a security control to harden, not a product surface to design. The result is a familiar mess. Customers face four-part password rules, MFA on every visit, and no clear way back in when something breaks.

The standards bodies have since moved. NIST, CISA, the UK's NCSC and the FIDO Alliance now agree that most of that friction does not make anyone safer.

The core rule: friction follows risk, not routine

Most brands apply the same checks to every login. A returning customer on the same phone, in the same city, on the same Tuesday evening gets the same MFA prompt as a new device abroad at 3 a.m.

The better model is risk-based (adaptive) authentication. You score every sign-in and every sensitive action, then add friction only when the score earns it.

Google's research shows why this works, and why it has a cost. Device-based challenges blocked 100% of automated hijacking attempts and over 94% of phishing-driven ones. Yet the friction caused 52% of legitimate users to fail to sign in, even though 97% got in within a short period. In a separate experiment, 38% of users did not have access to their phone when challenged. That lockout risk is why Google does not challenge every sign-in.

A challenge is powerful and expensive. Spend it where risk is real.

Signals worth scoring

• Device: known and bound to the account, or new.
• Network and location: familiar, or a new country, a hosting provider or an anonymizer.
• Velocity: impossible travel, many accounts from one IP address, or many attempts on one account.
• Credential health: whether the password appears in a known breach set.
• Action: browsing is low risk, while changing the payout account is high risk.

The score produces a decision, not a prompt

1. Low risk: let the user in silently.
2. Medium risk: ask for one quick, phishing-resistant check, such as a passkey or a confirmation on a known device.
3. High risk: block, or require a strong step-up and notify the account owner.

A concrete case: a shopper signs in from her usual laptop and sees only her cart. Next morning, someone with her leaked password tries from a foreign data center. That attempt hits a passkey check it cannot pass, and she gets an email.

My working benchmark, not a published standard: if more than a small single-digit share of returning users see an MFA prompt on a typical day, the risk engine is not doing its job.

Guideline 1: Drop the password complexity rules

"One uppercase, one number, one symbol, change it every 90 days" is no longer best practice. It now contradicts the federal standard.

NIST SP 800-63B Revision 4, finalized in July 2025, says verifiers shall not impose composition rules and shall not require periodic changes. A forced change is required only on evidence of compromise. New passwords must be checked against a blocklist of commonly used, expected or compromised passwords.

Old habit	What NIST Rev 4 says	What to ship
Upper, lower, number, symbol	Shall not impose composition rules	Remove the rules and the red checklist
Rotate every 60 to 90 days	Shall not require periodic change	Force a reset only on evidence of compromise
8-character minimum for everyone	15 minimum when the password is the only factor, 8 when it is part of MFA, allow at least 64	Encourage passphrases and never cap length low
Security questions and hints	Shall not prompt for them	Delete them
Block paste in password fields	Shall allow password managers and autofill, should permit paste	Let autofill and paste work everywhere
Strength meter only	Check against a blocklist of compromised passwords	Screen new passwords against breach data in real time

In practice, complexity rules produce "Summer2026!" and a forgotten-password ticket a month later. Rotation then produces "Autumn2026!", and the attacker who stole the first one guesses the second.

If you want to see breach screening from the user's side, try my free password breach check. It shows what a blocklist check catches that a strength meter misses.

The brand takeaway: the best password policy is the one your users rarely need.

Guideline 2: Make passkeys the default path

Passkeys improve security and experience at the same time. A passkey is a cryptographic key pair stored on the user's device or synced through their platform account, unlocked with a fingerprint, face scan or device PIN. It is bound to your domain, so a phishing page cannot use it.

The October 2026 FIDO Passkey Index, built on data from 15 consumer services, makes the case in plain numbers.

Measure	Passkeys	Passwords and traditional MFA
Sign-in success rate	93%	78%
Sign-in speed	2.8x faster, about 27 seconds saved per sign-in	Baseline
Share of successful sign-ins	36%, up from 26% in 2025	The remainder

Every 2026 participant that measures phishing saw successful attacks fall after deploying passkeys. The 2025 Index reported an 81% reduction in login-related help desk incidents.

NIST now accommodates passkeys too. Rev 4 says a common use of syncable authenticators is AAL2 (NIST's multi-factor assurance level). When the device verifies the user with a biometric or PIN, the passkey can count as a multi-factor authenticator. One face scan replaces a password plus a code.

How to roll it out without forcing anyone

1. Turn on passkey autofill (WebAuthn conditional mediation) on the existing username field. Users with a passkey see it in the autofill menu they already use.
2. Prompt for a passkey right after a successful sign-in, when the user has just proven who they are.
3. Use conditional create where the browser supports it. Chrome documents how a site can create a passkey automatically right after a full password sign-in, with no extra prompt.
4. After a cross-device (QR code) sign-in, offer a local passkey so the next login skips the QR step, as the web.dev passkey checklist recommends.
5. Use the forgot-password flow as an enrollment moment. Offer a passkey instead of a new password, because nobody is more receptive than someone who just forgot one.
6. Do not force enrollment at first signup for consumers. Make the passkey the obvious default instead.

The metric that matters is usage, not enrollment. In the 2026 Index, 8 of 10 participants that report both numbers still had a passkey sign-in share below their enrollment rate. Their users had a passkey and were not routed to it. If your login page buries the passkey button under a password form, you paid for the feature and kept the friction.

My complete guide to passwordless authentication covers the broader technology, from magic links to B2B rollout.

Guideline 3: Stop asking for MFA again and again

Repeated MFA prompts are not extra security. They train users to approve prompts without reading them, and attackers exploit exactly that habit.

CISA calls it MFA fatigue, or push bombing: an attacker with a stolen password bombards the user with push notifications until one gets approved by accident or out of annoyance. A brand that prompts constantly has already done the attacker's conditioning for them.

Ask once, remember the device, step up at sensitive moments

The UK NCSC describes the model directly. Users complete MFA on a device the service has not seen before and can choose to have it remembered. The service does not need to ask again until that device becomes untrustworthy. Separately, it requires MFA again for high-risk actions, such as changing an important setting or approving a large transaction.

Microsoft Entra ID flags tenants that remember MFA on trusted devices for less than 30 days and recommends at least 90.

On session length, NIST Rev 4 says the overall reauthentication timeout should be no more than 24 hours at AAL2. For consumer accounts, keep a long-lived session on a trusted device and ask for fresh proof only when the user does something that matters. With a passkey, that proof is a two-second face or fingerprint scan, not a six-digit code.

Pick factors by phishing resistance, not familiarity

Factor	Phishing-resistant	Main weakness	Where to use it
Passkey or FIDO security key	Yes	Recovery when every device is lost	Default for sign-in and step-up
Authenticator app code (TOTP)	No	A phishing page can relay it	Fallback for users without passkey support
Push with number matching	No	Resists push bombing, still phishable	Interim control while migrating
Push without number matching	No	Push bombing	Retire it
SMS or voice code	No	SIM swap, SS7 interception, phishing	Last-resort fallback only

The ranking follows CISA's phishing-resistant MFA fact sheet, which puts FIDO/WebAuthn at the top and SMS or voice at the bottom. NIST Rev 4 requires AAL2 verifiers to offer at least one phishing-resistant option. It also lists SMS and voice codes as a restricted authenticator, which obliges the provider to offer an unrestricted alternative and explain the risks.

Three rules that remove most MFA pain

1. Never stack a code on top of a passkey. A user-verified passkey has already proved two factors.
2. Never prompt twice in one session for the same level of access.
3. Notify the user of every new device, new factor and recovery event. The real owner can then spot a takeover without being interrupted the rest of the time.

Guideline 4: Design the login screen like a product, not a wall

The cheapest login is the one you never ask for. In Baymard's research, 18% of US online shoppers who abandoned an order did so because the site wanted them to create an account.

Before login: do not ask for an account you do not need

• Let people buy, browse or try as a guest. Offer the account on the confirmation page, where saving a passkey takes one tap.

The screen itself

1. Use an identifier-first flow. Ask for email or phone, then route to the right method: passkey, single sign-on for business domains, or password.
2. Turn on browser and password manager autofill with the autocomplete value "username webauthn", and never block paste.
3. Show "Sign in with face or fingerprint" as a peer to the primary button, not a link at the bottom.
4. Offer Apple or Google sign-in when your audience uses it. Handle account linking so the same person never ends up with two accounts.
5. Add a show-password toggle, and keep the email filled after a failed attempt.

Error copy that helps users without helping attackers

• Use one message for a wrong email or a wrong password, such as "That email and password don't match. Try again or reset it." Saying which one was wrong lets attackers enumerate accounts.
• Show a CAPTCHA only when risk signals justify it. A default CAPTCHA punishes every human to slow down a few bots.

Recovery is part of login

Once passwords fade, recovery becomes the sign-in method attackers aim at, usually through a help desk or a support chat. Design it with the same care as the front door:

• Let users register at least two recovery methods at a calm moment, not during a lockout.
• Use magic links or one-time email codes for recovery, with a clear expiry and single use.
• Give support agents a scripted verification process that never bypasses the account's own factors.
• After recovery, offer a passkey immediately and notify the user on every other device.

The friction map: invisible where users live, firm where damage happens

Use this as a starting policy and tune it to your own fraud data. The shape holds across retail, media, SaaS and fintech.

User action	Risk	Default experience	Add friction when
Browse, read, search	Low	No login needed	Never
Add to cart, save, like	Low	Guest or silent session	Never
Return visit, same device	Low	Stay signed in	Session expired or device signals changed
Sign in on a new device	Medium	Passkey, or password plus one factor	Always on first use, then remember the device
Checkout with saved payment	Medium	Passkey or device biometric	New shipping address plus new device
View sensitive data (health, statements, tax)	Medium to high	Fresh passkey check if the session is old	Session older than your set window
Change email, phone or password	High	Step-up with a phishing-resistant factor	Always, plus notify the old contact point
Add a payout account or move money	High	Step-up with a phishing-resistant factor	Always, with a hold on first-time payees
Add a new passkey or MFA method	High	Step-up with an existing factor	Always, plus notify all devices
Account recovery	Highest	Verified recovery factor and a cool-down period	Always, and never bypassable by support alone

The top half is where users spend most of their time, and it should feel as if no security exists. The bottom half is where account takeovers turn into losses. Reinvest every bit of friction you remove from the top into the bottom.

Here the vendor matters, because not every identity platform can score risk per action or step up mid-session. The ebook's vendor selection chapter lists ten questions to ask every vendor. Its shortlist chapter groups vendors by the situation each serves best. For independent profiles and comparisons, use CIAM Compass.

Login quality scorecard: 20 checks a brand can run this week

Score one point per check. A score of 17 to 20 is a strong login. Under 12 means login is likely costing you customers today.

Passwords

• No composition rules (upper, lower, number, symbol).
• No scheduled password expiry, with a reset only on evidence of compromise.
• New passwords screened against breached and common password lists.
• Paste and password manager autofill work on every field.
• No security questions or password hints.

Passkeys

• Passkey sign-in available on web and mobile.
• Passkey autofill enabled on the username field.
• Passkey offered right after sign-in and after a password reset.
• Passkey shown as a primary option, not hidden in settings.

MFA and sessions

• Users can mark a device as trusted for 30 days or more.
• Step-up is tied to specific sensitive actions, not every visit.
• No code requested after a passkey sign-in.
• Push approvals use number matching, or push is retired.
• SMS is a fallback, never the only second factor.

Login screen and checkout

• A guest path for purchases and trials, with the account offered afterward.
• An identifier-first flow that starts with one field.
• Error messages that do not reveal whether an email exists.
• A CAPTCHA only on risk signals.

Recovery and trust

• Users are notified of new devices, new factors and recovery events.
• Support agents cannot bypass account factors without a verified process.

One exercise beats a quarter of dashboards. Ask three people outside your team to sign in on a new phone, buy something and change their email address. The scorecard chapter turns this into a repeatable monthly review.

Measure login like a funnel

Security teams track blocked attacks and product teams track conversion. Almost nobody owns the login funnel between them.

Metric	What it tells you	Direction
Sign-in success rate on the first attempt	How often a real user gets in without help	Up (passkeys reach 93% in the FIDO Index)
Median time to sign in	The friction users feel	Down
MFA prompts per active user per month	Whether the risk engine is working	Down
Passkey share of successful sign-ins	Real adoption, not enrollment vanity	Up
Password reset requests per 1,000 users	Hidden churn and support cost	Down
Login-related support tickets	The direct cost of friction	Down
Abandonment at the login or signup step	Revenue lost at the door	Down
Account takeover rate	Whether less friction cost you safety	Flat or down

The last row is the guardrail. If every other metric improves while account takeovers stay flat or fall, you have proven the point of this guide. Security and experience were never a trade. Bad login design was hurting both.

To sequence the work, the ebook's 90-day rollout plan runs three phases with a gate between each: remove the obvious pain, launch passkeys, then move friction to where risk lives. If you are still choosing a method, my matrix and rollout checklist help with that first decision.

FAQ

Does removing password complexity rules make accounts less secure?

Not when you replace them with what NIST requires instead. SP 800-63B Rev 4 drops composition rules but requires a 15-character minimum for single-factor passwords and screening against compromised-password lists. Length and breach screening stop the attacks that complexity rules only slowed down.

Should a consumer brand force users to create a passkey?

No. Offer it at the right moments: after a successful sign-in, after a password reset and on the order confirmation page. Make it the default path for anyone who has one. Forcing enrollment at signup adds friction at the point where you are most likely to lose the customer.

How often should a returning customer see an MFA prompt?

Rarely. Follow the NCSC model: verify once on a new device, remember it, and step up only for sensitive actions such as changing an email address or adding a payee. In my experience, a high daily prompt rate usually means the risk engine is not scoring signals at all.