Delivering Passwordless Login for 41M+ NHS Users

Adopting the term ‘Passkey’

The term ‘passkey’ was initially unfamiliar to many users, raising concerns about potential confusion or hesitation during onboarding. To explore this, we tested alternative phrasing such as ‘Register a device’ in early prototypes and user flows.

Ultimately, our decision to adopt ‘passkey’ was guided by several key factors:

• Alignment with industry terminology: Apple and Google use ‘passkey’ in their ecosystems, making it important for users to recognise this term when managing passkeys in their device and browser settings.

• Consistency with FIDO2 UI: Passkey pop up which is managed by the device and operating system uses the term ‘passkey’. We have no control over its content, so alignment was essential to avoid confusion.

• Avoiding confusion with biometrics: We wanted to avoid users being confused between passkeys and the traditional biometrics.

• Preventing misconceptions: When we replaced the term ‘passkey’ with more familiar phrases, users felt more confident. However, inadvertently this led to misunderstandings, with some users mistakenly assuming they would receive security alerts on their devices.

• User adoption: Our decision to adopt ‘passkey’ was reinforced when we noticed users became more comfortable with the term after seeing it in context on the pop up and continued using it throughout their interactions.

Creating a device-led experience

During testing, we found that providing upfront instructions often led to cognitive overload and reduced user confidence.

Since passkey flows are managed by operating systems, the experience varies across devices and browsers. This inconsistency makes it difficult to offer accurate, step-by-step guidance—and maintaining these instructions becomes even more challenging as OS interfaces evolve.

Instead, we designed the experience to be led by the user’s device. When prompted directly by their system, users were more focused, confident, and able to follow along intuitively. Many gained a clearer understanding of passkeys simply by completing the process themselves.

Avoiding information overload

User testing revealed a clear pattern: the more we tried to explain what a passkey is, the less confident users felt.

With passkeys still being a new concept for many, overloading users with technical details—about security or how the technology works—often led to confusion and hesitation. While our intention was to inform, it ended up creating unnecessary friction.

What users really want is a smooth, secure experience they can trust. They rely on the service to manage the security, not to explain it. By simplifying the messaging and keeping information minimal, we were able to build trust and make the journey feel intuitive. This allowed users to stay focused on completing their task, without being distracted or overwhelmed by complexity.

Building user confidence through familiar references

When introducing a new concept like passkeys, it's tempting to include detailed explanations to reassure users. In early testing, many said they wanted more information about what a passkey is and how it works.

However, this didn’t align with their actual behaviour. During prototype testing, users often felt overwhelmed when presented with too much information upfront.

To explore this further, we ran an unmoderated test using an accordion-style component that let users expand and read more at their own pace. Out of 15 users, only 2 opened the additional content—and even then, they only skimmed it.

What stood out instead was the power of familiar language. Terms like ‘fingerprint’ and ‘Face ID’ immediately resonated with users and gave them a mental model of what to expect. These recognisable references were far more effective in building confidence and encouraging users to proceed than detailed explanations ever were.