Reducing Authentication Friction

Two surfaces had to work together: a universal login page for anyone who didn’t know their company’s domain, and a company login page configured per organization. The universal page only identified you — after entering an email and a login code, you landed on your company’s page and had to fully authenticate again, often with a second code. Users thought the system was broken.

The old sign-in surface made it worse: several competing primary buttons, an “SSO Login” button that never said whether it meant Google or Microsoft, and a reset flow that looked like a different product entirely.

My PM brought me a known pain point: heavy support volume around login. I turned it into a quantified case — I pulled the support numbers, interviewed account managers and customer-success reps, ran discovery sessions, and had our tech lead query a year of login attempts broken down by method.

I tested three sign-in surfaces with 75 people across the company — the old design as control, an SSO-first layout, and a password-first layout — using heatmaps and task metrics. SSO-first cut the login-method decision from 27 seconds to 5.9 and lifted reported confidence over the old design. Password-first was even faster at 4.6 seconds — and edged out SSO-first on confidence, too.

I chose the slower one. Password-first earned its speed by reinforcing the one method that failed two times out of three — winning the task metric while working directly against the point of the redesign. SSO-first routed users to the method that actually works. Speed wasn’t the goal; the right path was.

The deepest fix wasn’t a screen — it was a token. In the new flow, the code you enter at universal login persists as a secure token that travels with you to your company’s page and counts toward its MFA requirement. If your company only requires a login code, you’re simply in. If it requires a password, your email is already on the page and the second code never happens.

I wireframed the entire flow end-to-end and took it through architecture review and the security team — it passed without material changes. My CS background carried those rooms: the proposal was legible to engineers because it was drawn in their terms, states and transitions, not just screens. Engineering owned the token’s implementation specs; the concept and the flow were mine.

The most-used login method was hiding behind the least meaningful label. “SSO Login” means nothing to a warehouse worker who signs into everything else with a Google button. The redesign resolves each company’s actual identity provider onto the button — Google, Microsoft, Okta — and themes the page in the company’s brand, with a gradient of their primary color behind the card.

That gradient sparked the project’s one real disagreement. My PM flagged that certain brands are strict about color use — it had caused problems before. Instead of arguing taste, I took it to the PM who owned brand-color issues in the product, got his read that it was safe, and designed an opt-out toggle account executives can flip for any brand that objects. Same design, with an escape hatch. Green light.

Mobile is the primary access point for deskless users, so small screens set the constraints: only relevant options shown, one streamlined path, and — the single most requested fix from support — SMS verification, so a code can reach a worker who has never opened their work inbox on a phone. The design then scales up to desktop, where extra space enhances the experience instead of defining it.

Watching people type in the coded prototypes surfaced a finding I didn’t expect: users forget their passwords constantly, and reset — a bare, off-brand page with a single blind input — was the highest-friction moment in the entire system. The redesign treats reset as a first-class flow: adaptive inline validation that reacts as you type, a live match check on the confirm field, a show-password toggle, and the same visual system as login, on web and mobile alike.

A Figma prototype can’t tell you where people struggle to type. I built the flows as working code in VS Code with Copilot — real fields, real validation, real code entry — on a feature branch the front-end engineers iterated on with me. Testing them with 20+ recruited admins and end users showed exactly where fingers hesitated: code entry, email input, and above all, password reset.

The workflow outlived the project: I contributed it to the team’s AI-prototyping guide and led its early adoption across the design org.

This project rewired how I work. Design proposals travel exactly as far as the evidence attached to them — the data pull is what turned an intern’s redesign into something architecture review took seriously. And the biggest UX win in the project wasn’t a page at all; it was a token. Redesign the state machine, not just the screens.

Rejecting the faster variant taught me to interrogate the question behind a metric before obeying it. And coding my own prototypes changed what I could learn: code isn’t the engineers’ territory I visit, it’s part of my design surface.

The honest edge of the work: some deskless workers — movie-theater staff, warehouse teams — aren’t allowed phones on the floor at all and log in from shared kiosks. SMS doesn’t reach them. With more time, kiosk research is the first thing I’d do.