Some systems are only used occasionally. A nominations portal that opens once a year. A grants system with two rounds. A member portal that most people only visit when a renewal is due. The system might be very good, but the experience of using it is dominated by one thing: nobody can remember their password.
The result is predictable. The round opens, the emails go out, and the help desk is buried in reset requests for a week. Some people give up. Some borrow a colleague's login. Some email their application as an attachment instead, which is exactly what the portal was built to stop.
Why passwords fail occasional users
Passwords work for systems people use every day because habit does the remembering. For a system used twice a year there is no habit. The user is being asked to recall a credential they set eleven months ago, under a policy that demanded a symbol and a number, for a site they had forgotten existed. Reset flows help, but each one is a few minutes of friction and a support ticket, and across a large cohort of infrequent users that adds up to days of lost time every round.
The security argument for passwords is also weaker than it looks in this situation. Infrequent users choose weak passwords, reuse them and write them down. A password nobody can remember is not protecting much.
What helps
- Single sign-on where it exists. If the users are staff in an organisation with a directory, let them log in with the account they already use every day. There is no new password to forget.
- Secure links instead of passwords. For users outside the organisation, send a cryptographically signed link that logs them straight in. The link is unique, expires and is tied to the invitation, so it is at least as secure as a password the user set in a hurry, and there is nothing to remember.
- Pre-filled invitations. When the user arrives through their link, the system already knows who they are and which program they belong to. The first screen is the task, not a registration form.
Designing for people who will only use it once
A system for occasional users has to be designed differently from one for daily users. Daily users learn the system over time. Occasional users have to be able to work it out from scratch every time, so each screen needs to explain itself, the path needs to be obvious, and the one thing they came to do needs to be in front of them when they arrive.
That was the brief for the NSW Public Service Commission nominations portal. Managers across the NSW Government nominate people for a leadership program once a year. We built password-free secure access so nobody needs another credential, tailored the questions to the program, and designed the review stages so that panel members who only see the portal a handful of times can score without reading a manual.
Secure, password-free access is a small change to build into a system and a large change in how it is experienced. If you are planning a portal for people who will rarely use it, or already running one that generates a wave of reset tickets every round, it is one of the first things worth fixing.
Have a look at what we build for government, or tell us about the portal and who has to log in to it.
