On this page
concept

Password Fatigue

Created 2026-08-02 33 connections

Password Fatigue

Password Fatigue describes the UX and conversion phenomenon where users — overwhelmed by the need to create, remember, and manage passwords across multiple sites — abandon checkout, skip account creation, or resort to insecure coping strategies (password reuse, throwaway credentials) when confronted with login or registration friction. In ecommerce, it is a direct cause of cart abandonment and a structural barrier to building registered-customer relationships.

The problem: scope and scale

The average US online shopper has not 168 passwords but, in practice, approximately three passwords reused across around 100 different services — meaning "password overload" is primarily a reuse and retrieval problem, not a memory-capacity one (Mike Slaugh, Amazon Principal Security Engineer, FIDO Alliance seminar, 2025-02-04).

In ecommerce checkout specifically:

  • 18% of US online shoppers in Baymard Institute's weighted survey have abandoned a cart because "the site wanted me to create an account" (Baymard, as-of 2025-09-22). Note: this figure varies by survey framing (see Contradictions section below).
  • Approximately 19% of users abandon carts specifically because they have forgotten their password at login — a figure cited by multiple secondary sources as originating in Baymard usability testing (Corbado, 2026-07-02; Baymard, 2022-11-29).
  • Baymard's direct observation found that users who hit a failed password reset flow — waiting for a reset email that is delayed, filtered to spam, or never arrives — abandoned checkout at an average rate of 18.75%, with individual sites reaching 19% abandonment at this step alone (Baymard, 2022-11-29).

The Baymard password-requirements article (2022-11-29) was included because it is the primary source for widely-cited figures. A 2026 Baymard update was not publicly available. Core mechanics (password reset flow abandonment, complexity rules) are structurally stable, but percentages should be treated as potentially superseded.

The total addressable-friction context: Baymard estimates $260 billion in recoverable orders annually in the US and EU combined from checkout usability improvements (as-of 2025-09-22), with 35.26% conversion rate improvement achievable by resolving checkout UX issues (as-of 2025-09-22).

How it manifests in checkout

1. Forced account creation gate

When presented with a mandatory registration screen before checkout, users faced with password creation demands experience what practitioners describe as commitment anxiety — being asked to commit to a business before the transaction is complete (Shantelle Liu, UXDX, 2024-09-03).

Corbado's funnel analysis describes a typical conversion path of: Add to Cart 100% → Begin Checkout 45% → Login Wall 34% → Payment 22% → Purchase 18%, with the login wall being the steepest single drop-off step (as-of 2026-07-02).

The UXDX / Shantelle Liu talk was published 2024-09-03. Funnel figures have been flagged stale_risk in the source; they are directionally consistent with 2026 Baymard/Corbado data but may not reflect current site behaviour.

62% of leading ecommerce sites fail to make the guest checkout option sufficiently prominent, directly contributing to abandonment among users who encounter a login wall (Baymard, cited by Corbado, 2026-07-02).

[!unverified] The 62% figure is attributed to Baymard by Corbado. The underlying Baymard article is paywalled; direct verification was not possible in this session.

2. Password complexity as a barrier on return visits

82% of ecommerce sites impose unnecessarily complex password requirements (combinations of uppercase, lowercase, special characters, and numbers) despite these rules primarily causing sign-in failures on return visits rather than improving security (Baymard, 2022-11-29).

Users develop personal coping formulas — such as city name + postal code, or Capital + 6 letters + 2 digits — but sites that deviate from common rule patterns break these strategies and force non-standard passwords that become harder to recall (Baymard, 2022-11-29).

3. "Database pollution" and the ghost user problem

When forced to register, users input throwaway emails or insecure simple passwords just to bypass the gate — degrading data quality (Corbado, 2026-07-02). When a customer buys as a guest multiple times with the same email, backends often treat each transaction as a separate record, making it impossible to calculate true LTV or segment high-value customers — Corbado calls this the "ghost user problem" (Corbado, 2026-07-02).

4. Mobile amplification

Mobile checkout abandonment reaches approximately 85%, with a 15-point delta from desktop (Corbado, 2026-07-02). The UXDX speaker attributed this specifically to the friction of typing email and password on a virtual keyboard. Passwordless mobile conversion improvement was 29.6% versus 18.4% on desktop according to MojoAuth's report, with 73% of ecommerce traffic occurring on mobile (MojoAuth, 2026).

[!unverified] MojoAuth is a vendor selling passwordless authentication. Their 2026 Passwordless Conversion Impact Report draws on 523.7 million authentication events across 14,892 implementations. The methodology has not been independently verified; treat directionally indicative, not as a controlled benchmark.

The guest-vs-registered trade-off

The structural tension that password fatigue creates:

  • Registered customers convert at 64% vs 52% for guest shoppers — creating a commercial incentive to require registration (Corbado, citing Ecommpay/IMRG, 2026-07-02; see also Post-Purchase Account Creation for the selection-bias counterargument).
  • Forcing registration pre-checkout costs more first-purchase conversions than the LTV uplift justifies for most traffic mixes — particularly for SEM and social mobile traffic, which has lower tolerance for login walls than direct traffic (Corbado, 2026-07-02).
  • The industry consensus solution is the Post-Purchase Account Creation pattern: complete the purchase as a guest, then offer account creation on the Thank You page (Corbado, 2026-07-02).

Corbado (2026-07-02) reports registered customers convert at 64% vs 52% for guests. A counterargument documented in Post-Purchase Account Creation (Cartylabs, cited in the hot.md summary) contends this 12-point gap is selection bias: buyers predisposed to return self-select into account creation; forcing others into accounts loses them at checkout without improving repeat behaviour. Neither source is independently verified with a controlled experiment.

Passwordless alternatives

All the following routes eliminate or reduce password dependency at different trade-off points:

Shopify's new customer accounts (launched January 2023, passwords deprecated February 2026) replace password sign-in with email + one-time verification code, eliminating password creation, storage, and reset flows (Shopify Changelog, 2026-02-26).

OTPs and magic links carry their own friction:

  • Users must wait for code delivery and switch apps to retrieve email magic links (NN/G, 2023-06-25).
  • Enterprise email security tools may open links to scan them, consuming single-use tokens before the real user clicks — making OTP preferable to magic links in B2B contexts (MojoAuth, 2026-03-12).
  • MojoAuth states that email OTP's security model is identical to magic links, but OTP has slightly higher phishing risk because a relay attack can prompt a code in real time (MojoAuth, 2026-03-12).
  • FBI and CISA issued formal guidance against SMS-only authentication in 2025; UAE mandated SMS OTP elimination from financial services by March 2026 and Philippines by June 2026 (MojoAuth, 2026-03-12).

NN/G (2023-06-25) documents that OTPs carry meaningful friction — delivery delay, inbox switching, spam filtering — and recommends sites offer users the option to attach a password even to passwordless accounts so those with browser autofill can sign in faster on return visits. Shopify's new accounts system (2026-02-26) eliminates passwords entirely with no fallback. These positions conflict on whether optionality or simplicity better serves the user.

NN/G article on passwordless accounts published 2023-06-25. No 2025-2026 NN/G update on this topic surfaced. Include as foundational framework; specific adoption figures may be outdated.

Social login (Google, Apple, Facebook)

Shopify added Google and Facebook social sign-in to customer accounts in 2025 (Shopify Changelog, cited in reddit-source adjacent findings, 2025). Social login removes the password creation step but transfers identity dependency to third-party providers.

Passkeys (FIDO2 / WebAuthn)

Passkeys are device-generated cryptographic credentials — the device stores an encrypted credential, biometric authentication unlocks it, and it is sent to the site without being stored by the website. They have lower interaction cost than both passwords and OTPs (no typing, copying, or clicking) and are phishing-resistant (NN/G, 2023-06-25).

Platform support (as-of 2026-03-12, MojoAuth): iOS 16+, Android 9+, Windows 10+, macOS Ventura+, Chrome, Safari, Firefox, and Edge. Apple introduced passkey portability between credential managers in iOS 26; Microsoft made passkeys the default for new accounts in May 2025.

FIDO Alliance Passkey Index (2025) key figures (as-of 2025):

  • 93% of user accounts at participating companies (Amazon, Google, Microsoft, PayPal, Target) are eligible for passkey sign-in (as-of 2025, MojoAuth citing FIDO Alliance).
  • 36% have enrolled a passkey (as-of 2025, MojoAuth citing FIDO Alliance).
  • 26% of all sign-ins are completed with passkeys — more than double year-over-year (as-of 2025, MojoAuth citing FIDO Alliance).
  • 61% of consumers see passkeys as more secure than passwords; 58% see them as more convenient (as-of 2024 FIDO data, cited by Shopify enterprise blog, 2026-03-17).

[!unverified] FIDO Alliance Passkey Index is the primary source for the above figures. That page could not be fetched directly in this session (cited via MojoAuth and Shopify as secondary sources). Verify at https://fidoalliance.org before treating as confirmed primary-source claims.

Adidas case study (web.dev, 2026-03-10):

  • Historical password sign-in success rate: 70% (Adidas, as-of pre-passkey deployment).
  • Passkey sign-in success rate: >99% (as-of Q1 2026).
  • Orphaned passkey credential errors kept below 0.3% via WebAuthn Signal API.
  • 47% overall passkey creation rate since launch (as-of Q1 2026) — mobile 52%, desktop 34%.
  • Conditional Create (automatic background passkey creation after a successful password sign-in) produced an additional 8% uplift without requiring user action (as-of Q1 2026).
  • Adidas frames it in direct ecommerce conversion terms: "any delay can potentially disrupt the path to purchase and lead to cart abandonment" (web.dev, 2026-03-10).

FIDO Alliance design principles (Mike Slaugh, Amazon, 2025-02-04):

  • Rule 1 ("Don't be a jerk"): use FIDO Alliance published UX design patterns (~14 published at passkeycentral.org), support cross-device sign-in, auto-detect existing passkeys.
  • Rule 2 ("Don't be stupid"): treat passkeys as a transition toward password elimination — not as an additional option stacked on passwords — because as long as a password exists, the account remains vulnerable to password attacks.
  • For consumer/ecommerce use cases: synced passkeys (not device-bound) are appropriate; device-bound passkeys suit higher-security scenarios.

FIDO Alliance talk published 2025-02-04. Passkey ecosystem is evolving rapidly; some figures (96% passkey success rate stated as approximate "last I heard") should be verified against current FIDO data.

Shop Pay (Shopify) conversion data (as-of 2026-03-17):

  • Princess Polly (fashion retailer): 4.1% higher conversion among buyers with an active Shop Pay session; 1.6% increase in total US store orders; 7.6% reduction in checkout completion time.
  • Shop Pay uses saved passkeys and one-time codes to pre-authenticate returning customers (Shopify Enterprise Blog, 2026-03-17).

Shopify Engineering deployed passkeys to Shop's authentication flows in December 2022, replacing email and SMS verification codes, noting: "the security of the Shop Pay account is only as good as the security of the email account and/or phone number associated with it, which varies depending on the provider" (Shopify Engineering, 2023-03-24).

Click to Pay (Visa / Mastercard)

Visa and Mastercard are pushing "Click to Pay" where the card network acts as identity provider, giving merchants registered-user data at guest-checkout speed — framing payment-network passkeys as a convergence of the guest-vs-account tension (Corbado, 2026-07-02).

Channel-segmented authentication

Corbado argues for channel-based authentication strategy: SEM and social traffic (often mobile, impulse-driven) benefits most from guest checkout / frictionless paths; direct and email traffic (higher purchase intent) is more tolerant of account login (Corbado, 2026-07-02).

The "email-first" checkout pattern — a single email field that replaces the binary login/register screen, then prompts existing users to authenticate while offering a guest fallback — is used by Wayfair, Amazon, and Nike (Corbado, 2026-07-02).

Platform direction (as-of 2026)

Shopify deprecated legacy password-based customer accounts on 2026-02-26. Legacy accounts are no longer available to new stores; a final sunset date for all remaining legacy stores is to be announced later in 2026. The stated benefit: "no more password resets or support tickets from locked-out customers" (Shopify Changelog, 2026-02-26).

This is the clearest platform-level signal that passwords are being treated as a solved-and-deprecated problem in ecommerce, at least at the SMB platform layer.

Security context: Verizon's 2025 Data Breach Investigations Report found 88% of basic web application breaches involve stolen credentials; MFA fatigue ("prompt bombing") appears in 14% of incidents — positioning both password-based and poorly-implemented MFA flows as active attack surfaces (cited by Shopify Enterprise Blog, 2026-03-17).

Contradictions

Account abandonment rate — 18% vs 19% vs 23% vs 24% vs 35%: Multiple figures co-exist for "users who abandon due to account creation friction": 18% (Baymard weighted survey, "site wanted me to create an account," 2025-09-22); ~19% (Baymard usability testing, forgotten password at reset flow, 2022-11-29); 23% (SaleCycle consumer survey, cited in Learn UX Design, 2026-06-18); ~24% (Baymard, cited in multiple secondary sources — appears to come from a different survey instrument); 35% (circulated in older Baymard references, possibly from a paywalled study). All are Baymard or Baymard-attributed; the variance reflects different question framings, survey populations, and study years. Use ranges not point estimates in any planning document.

Baymard vs Shopify on the right fix: Baymard's 2022 prescription for password friction is to minimise complexity requirements (6-8 character minimum only) — treating password persistence as a given and making it work better. Shopify's 2026 platform direction treats password elimination (via OTP or passkey) as the correct response, not simplification. These are not incompatible in a transitional sense but represent different planning time horizons.

NNG optionality vs Shopify elimination: NN/G (2023-06-25) recommends that even passwordless accounts offer users the option to later attach a password so those with password managers can autofill on return visits. Shopify new customer accounts (2026-02-26) eliminate passwords entirely. These positions conflict on whether user optionality or platform simplicity better serves the user in the long run.

Key terms

TermMeaning
Password FatigueCognitive and behavioural burden from managing passwords across multiple sites, leading to abandonment or insecure shortcuts
Ghost User ProblemWhen a guest buyer's multiple transactions are recorded as separate unlinked records, making LTV calculation impossible
Email-First PatternCheckout flow that starts with a single email field; adapts based on whether the email is recognized, avoiding a binary login/register choice
Conditional CreateBackground passkey creation triggered silently after a successful password sign-in, requiring no user action
WebAuthn Signal APIAPI that syncs device and server credential states to prevent orphaned passkey errors
Click to PayVisa/Mastercard identity network allowing returning users to authenticate via card network rather than merchant account
PasskeyDevice-generated FIDO2/WebAuthn credential; phishing-resistant, biometric-unlocked, not stored by websites

Benchmarks (as-of dates noted)

MetricValueSourceAs-of
Average cart abandonment rate70.22%Baymard (50-study aggregate)2025-09-22
Abandon due to forced account creation18%Baymard (weighted survey)2025-09-22
Abandon due to forgotten password at reset~19%Baymard (usability test)2022-11-29
Sites with overly complex password requirements82%Baymard2022-11-29
Sites with mediocre+ accounts UX73% (desktop), 66% (mobile)Baymard2025-08-14
Registered vs guest conversion rate64% vs 52%Corbado/Ecommpay/IMRG2026-07-02
Adidas passkey creation rate (overall)47%web.dev / AdidasQ1 2026
Adidas password sign-in success rate70% → >99% with passkeysweb.dev / AdidasQ1 2026
FIDO Alliance: passkey enrollment36% of eligible accountsFIDO Alliance Passkey Index (via MojoAuth)2025
FIDO Alliance: passkeys as % of sign-ins26% (2× YoY)FIDO Alliance Passkey Index (via MojoAuth)2025
Princess Polly Shop Pay conversion lift4.1% higher conversion, 1.6% more ordersShopify Enterprise Blog2026-03-17

What practitioners report

Reddit MCP was unavailable in the 2026-08-02 harvest session. No direct practitioner voices from Reddit could be captured. Gap noted — a future harvest should re-run the Reddit stream for this topic when the MCP is available.

Adjacent signal (from non-Reddit sources, labelled accordingly):

  • FIDO Alliance survey (Aug 2024): 42% of consumers abandoned a purchase in the past month because they could not remember their password; 50% of 25-34 year-olds vs 17% of 65+ (cited in eMarketer, Dec 2024).
  • Descope State of Customer Identity 2025: 87% of organizations still use password-based auth for customer-facing apps; only 2% believe passwords effectively balance security and UX (cited in adjacent industry signal from the reddit-source agent, 2026-08-02).

The following concepts are referenced here but do not yet have their own vault pages:

Related

Post-Purchase Account CreationPasswordless AuthenticationProgressive ProfilingPost-Purchase Email SequencesGuest CheckoutCheckout AbandonmentPasskeysSocial LoginOne-Time Passwords (OTP)Magic LinksStrong Customer Authentication (SCA / PSD2)
Research agent · 2026-08-02