Pioneering passwordless authentication in public sector

Key design decisions

Adopting the term ‘Passkey’

Initially, we were unsure whether to use the term ‘passkey’ as it was unfamiliar to users, and potentially could cause hesitation. We tested this by using alternative phrases like ‘Register a device’.

Eventually, our decision to use ‘passkey’ was influenced by several key factors:

• Alignment with industry terminology: Apple and Google use ‘passkey’ in their ecosystems, making it important for users to recognise this term when managing passkeys in their device and browser settings.

• Consistency with FIDO2 UI: Passkey pop up which is managed by the device and operating system uses the term ‘passkey’. We have no control over its content, so alignment was essential to avoid confusion.

• Avoiding confusion with biometrics: We wanted to avoid users being confused between passkeys and the traditional biometrics.

• Preventing misconceptions: When we replaced the term ‘passkey’ with more familiar phrases, users felt more confident. However, inadvertently this led to misunderstandings, with some users mistakenly assuming they would receive security alerts on their devices.

• User adoption: Our decision to adopt ‘passkey’ was reinforced when we noticed users became more comfortable with the term after seeing it in context on the pop up and continued using it throughout their interactions.

Creating a device-led experience

In testing, we observed that providing upfront instructions led to cognitive overload, which ultimately reduced user confidence.

Passkeys are managed by the operating systems, resulting in varying user experiences across different devices and browsers. This inconsistency makes providing instructions challenging and complicates maintenance as operating systems make updates to their UI.

When guided by their device, users were able to focus better and follow on-screen prompts. They developed a better understanding of passkeys once they actually went through the process.

Avoiding information overload

In testing, we found that the more we tried to explain what a passkey is, the less confident users felt.

Passkeys are still unfamiliar to most users, making it easy to overwhelm them with too much information. While the intention was to educate, details about security, and how passkeys function only led to confusion and hesitation.

Users trust the service to handle security, so they don't want detailed explanations. Providing concise and minimal information helps build confidence and makes the experience more intuitive. Simplifying the messaging ensured that users can focus on the task at hand, rather than being distracted or discouraged by complex details.

Building user confidence through familiar references

When introducing a new concept like passkeys, it’s tempting to provide detailed explanations to address user concerns.

In early testing, users expressed they would like more details about what a passkey is and its benefits as a way to encourage them. However, this conflicted their behaviour. During prototype testing, users often felt overwhelmed by the amount of information.

To explore this further, we set up an unmoderated testing. We used an accordion style component that allowed users to expand and read additional details at their discretion. Only 2 out of 15 users opened the details, and even then, they only skimmed through the content.

On the other hand, users immediately noticed 'fingerprint and face ID' in the content. These familiar terms were enough to encourage them to proceed with setting up a passkey as that gave them an idea of what to expect with passkeys.