According to a survey conducted by NordPass in 2024 the average number of passwords a user has to remember is 168.

When I first started using online services, most of my passwords were the names of my pets. 

I’ve only ever had 3 pets. 

I was lucky I never got hacked, but my wife wasn’t as fortunate.

On a quiet, unassuming Sunday evening, she received a warning on her iPhone of suspicious activity on her Uber account. Someone 300 miles away had signed in to it. This situation escalated quickly.  In a matter of minutes, she was locked out of various accounts as she frantically tried to change passwords on others. It was like playing a game of whack-a-mole. The pressure was two-fold as she struggled to think up new passwords she could remember.

‘Set up a passkey’, I told her.

‘What the heck is a passkey?’… she calmly replied.

‘That thing I keep telling you about. The thing I’ve been working on for the last 12 months, I sighed.

Most of us Hippos on the NHS login design team began with exactly the same question my wife asked. It was the best place to be. We had the same assumptions as our users.

From a design point of view, it was a challenge to explain:

  • What a passkey was
  • Why they should set one up
  • How to set one up and use it

So. What is a passkey? 

A passkey is basically a way to log in without a password. You use your phone or other device to prove who you are before accessing your account. They can’t be stolen like passwords and you never need to remember them as users don’t have to manually enter anything. They work by pairing a private key stored securely on the user’s device, with a public key stored by the service. They allow users to log in using their fingerprint, face ID or any other method they use to unlock their device such as pattern or PIN.

Password pain relief

The existing 2-factor authentication method for signing in to NHS login, relied on users having access to a working phone and signal. They also needed data to receive a one time security code and to remember a password.

This could be a severe headache for our users. 

And passkeys were their paracetamol.

Our vision was to provide a seamless experience for users to access their account in a secure and timely manner.

Over many months, we ran 5 rounds of research with a total of 66 participants.  

These sessions informed us of the pain points our users were likely to face, particularly those with low digital skills or trust issues. Having never heard of passkeys, some users were a little sceptical of how secure they were.

“It saves my face? How? Where? What happens if YOU get hacked?”

One senior manager said it was easy to use and it all felt quite secure, but he would still prefer to use his password… because it’s what he was used to. He also told us he’d been hacked in the past. And then he suggested that instead of passwords or passkeys, we should just let users sign in with their NHS number.

Confidence trickery

At first, we tried to avoid using the word ‘passkey’. Many users were not familiar with it. Instead, we tried to explain how they could use biometrics on their device. However, there are steps in the journey where messages generated by different operating systems specifically refer to passkeys.  We couldn’t really challenge the content used by Apple, Microsoft and Google, so we went with the flow.

Writing content that gave users the confidence to set up a passkey wasn’t easy. 

It was important to help users understand how they worked, but we didn’t want to overcomplicate it. Instructions on what to expect confused users because behaviour differs from one device or browser to another. With too many conditional statements it felt wiser to prioritise the content most of our users needed to see.

We also learned that we shouldn’t force passkeys on users. Whilst we know they’re a great idea, they’re not mandatory and older devices might not support them. We created an interrupt screen that displayed a brief message when users signed in to NHS login. It explained the benefits of using passkeys with the service and gave them the option to use one. However, we also allowed them to skip the process. And to avoid users feeling like my wife, who doesn’t enjoy being nagged by a content designer, we didn’t show them this message again for 180 days.

There was also the challenge of telling users how to change, delete or name their passkey. This was sometimes too much to include in the user journey, so we created help centre articles they could refer to. We also developed a process in the back end that could identify the device and browser they were on and label the passkey in their settings. 

Throughout testing, users reacted positively when asked about the potential of a passwordless login. They liked the security aspect and how fast the process was.

And from a business point of view, the benefits were easy to sell to our stakeholders. They included:

  • Less support requests for account recovery and password resets
  • Reduced cost of sending OTPs (one time passwords)
  • Reduced security risks and liability in case of a cyber attack
  • Reduced friction in the user journey, so increased user satisfaction

After many months of iterations, we launched passkeys on NHS login in February 2024. In the first week there were 1,000 users. By week 2 we had 5,000. As of today, there are 650,000 users with passkeys and 550,000 monthly logins.

What helped me to understand passkeys better was to set one up on NHS login and use it for myself. I now also have passkeys for all the major apps and websites I use.  

And I don’t have to remember the name of my dead hamster.

However…

My wife still hasn’t set up a passkey.

Find out more about digital identity