CONVERSION RATE OPTIMIZATION
Marketing owns the funnel right up to the moment a visitor has to create an account. After that it becomes someone else’s problem. That handoff is where a lot of paid traffic quietly disappears.
The signup and login screens are the last thing between intent and revenue. They are also the screens marketing teams have the least say over, because they usually get built once, by engineers, against a security checklist rather than a conversion target. Nobody reviews them again.
Start with the number everyone in ecommerce already knows. Around seven in ten shopping carts are abandoned before checkout completes. What gets less attention is the breakdown of why.
Price surprises lead, which is not news. Second on the list is the account wall. Roughly 26% leave specifically because they were told to create an account before they could pay. That is a design decision, not a market condition.
The same pattern runs through B2B. A demo request form that opens with “create your password” converts worse than one that does not. A trial signup that sends a verification email and then asks for a password on return loses people at both steps. None of this shows up as a login problem in your analytics. It shows up as a bad week for signups.
Even the password field on its own is expensive. Form analytics put its drop-off rate higher than any other common input, at around 10.5%. Users hit vague requirements, get no feedback until submit, and cannot see what they typed. Then they leave.
The second cost lands in a different budget, which is part of why it goes unnoticed.
Password resets are a large and boring share of every helpdesk queue. Estimates put them at 20% to 50% of all tickets, at around $70 each once you count staff time and the productivity lost while someone waits. Run that against your own user base and the number gets uncomfortable quickly.
For consumer brands there is a second version of the same problem. A customer who cannot remember their password does not always reset it. Sometimes they just do not come back, and the reacquisition cost lands in your paid budget instead of your support one. The reset flow is not a helpdesk process. It is a churn event with a form attached.
The fix that has been proving itself over the past two years is removing the password rather than improving it.
Passkeys let someone sign in with the same fingerprint or face they use to unlock their phone. The conversion numbers are unusually clear for something in this category. Reported login success rates run around 93% with passkeys against roughly 63% with passwords. That thirty-point gap is not a security metric. It is the share of people who make it through the door.
Individual results back it up. KAYAK cut sign-in and signup time by half, with two thirds of new users choosing passkeys when offered. Air New Zealand saw login abandonment halved after rolling them out. Dashlane reported a large lift in sign-in conversion against passwords.
Two smaller changes are worth doing first, because they cost almost nothing:
Offer guest checkout properly, and prominently. Then offer account creation on the confirmation page, once you already have the person’s details and their money.
Turn on autofill and use real-time field validation. Both are unglamorous and both measurably reduce abandonment on mobile, where most of your traffic already is.
Here is where marketing usually gets stuck. The login experience is controlled by whatever identity system engineering installed, and most of those systems come with a fixed interface you are expected to work around.
Keycloak is the common example. It is capable, widely used and free, but it was built as a self-hosted product with an admin console at the centre. The login pages it produces are themeable up to a point and awkward beyond it.
Teams that want a branded, tested, continuously optimised signup flow tend to hit that ceiling and start looking at keycloak alternatives. The practical differences show up in deployment, upgrade downtime and how much of the login screen you actually control.
The distinction that matters commercially is whether the system is headless. A headless identity platform handles the security and hands you the interface, which means your team designs the signup screen the same way it designs a landing page.
Ory is the one most often benchmarked against Keycloak on exactly that point, since it is API-first by design and can run self-hosted or fully managed depending on what your engineering team wants to own.
You do not need to have an opinion on the architecture. You do need to know whether your current setup lets you A/B test a signup form, because if the answer is no, that is a marketing constraint being decided by an infrastructure choice.
Four numbers, none of which require engineering work to start tracking:
Signup completion rate. Of everyone who lands on the create-account screen, how many finish. Segment by mobile and desktop, because the gap is usually large.
Login success rate. Of everyone who attempts a sign-in, how many get through on the first try. Anything under 80% is costing you sessions.
Password reset volume. Monthly count, multiplied by your cost per support contact. That is a real line item, currently sitting in someone else’s budget.
Post-reset return rate. Of the people who request a reset, how many actually complete it and come back. This one tends to surprise people.
None of these are security metrics and none of them belong to the security team. They describe how many people who wanted to buy from you were able to.
The login screen is not infrastructure. It is the last step of the funnel, and it is probably the least optimised page you own.
