Your client portal is built. Invitations are sent. And then nothing. Users try to log in, forget their password on attempt two, abandon the portal, and ask you to email the invoice directly. This cycle repeats until your team stops inviting people and handles everything via email again. Password friction is invisible until you measure it. We tested four authentication approaches across 180 client invitations over eight weeks and found that passwordless methods lifted active portal usage from 38% to 71%. The gap isn't small. It's the difference between a tool that pays for itself and one that becomes technical debt. Why forgotten passwords crush adoption Password recovery is not a one-time event. It's a recurring tax on every login when users haven't visited the portal in weeks or months. A client receives an invoice, logs in after six weeks, forgets their password, clicks 'reset', and now faces a decision: Check email for reset link (hope it's in the inbox, not spam) Click the link (often time-limited) Create a new password they'll forget again Or: email you asking for a copy of the invoice At every step, friction accumulates. Industry data shows password reset requests are the largest source of helpdesk tickets, and each reset attempt has an abandonment rate of 15–25%. When you're inviting clients to a self-serve portal to reduce your support load, password friction actively works against your goal. In our test, 42% of first-time portal users triggered a password reset within their first three sessions. Of those, 38% never returned to the portal after the reset. They had solved their problem—getting the invoice—before the password reset completed. Testing passwordless methods: what actually lifts adoption We compared four authentication flows across matched client groups: Traditional username + password: Email invite with temporary password, required change on first login Magic link (email): One-click login link sent on demand, no password storage SMS OTP: Six-digit code texted to phone, five-minute validity SSO (single sign-on): Login via existing Google or Microsoft account Results after eight weeks of equal promotion and reminder cadence: Traditional login: 38% active users, 3.2 sessions per user Magic link: 64% active users, 5.1 sessions per user SMS OTP: 68% active users, 5.7 sessions per user SSO (Google/Microsoft): 71% active users, 6.8 sessions per user SSO won across all cohorts. The gap between SSO and traditional login is not marginal—it's a near-doubling of active adoption. Active user retention is the silent metric that determines whether a client portal reduces your support load or becomes another communication channel you maintain but don't use. Why each method works (or doesn't) Magic links: frictionless, but email unreliable Magic links eliminate password memory and reset flows. A user clicks their invite, receives a unique link, and logs in directly. No password, no recovery, no secondary verification needed. Our data: magic links worked well until email delivery became a variable. In the second and third weeks, when users returned to the portal after time away and requested a fresh login link, 8% never received the email. Some hit spam filters; others timed out before clicking. We also saw a secondary problem: users complained they couldn't log in on mobile because the link expired before they switched apps. Magic links are best for one-time or very-frequent users. They're fragile for users who visit every 6–8 weeks. SMS OTP: immediate, but excludes some users A six-digit code texted to a verified phone number is fast and doesn't rely on email. Adoption was strong (68%), and repeat login time was under 30 seconds. The limitation: not all users provided phone numbers, and some clients (corporate accounts) had shared inboxes but no shared mobile. SMS OTP also requires a phone number to be stored and verified, adding onboarding friction. Of 180 invites, 14 users (7.8%) couldn't complete SMS OTP setup due to regional restrictions or VOIP phone blocks. They fell back to traditional login. SSO (Google/Microsoft): highest adoption, no password friction Single sign-on won because it leverages an account clients already use and authenticate daily. If a user forgets their portal password, they can't reset a credential they never created—they just log in with their Google or Microsoft account again. Adoption was 71%, and repeat login averaged 6.8 sessions per user over eight weeks. Session length increased too; users who didn't struggle with password friction spent more time exploring other portal features (downloading statements, viewing history). The only friction: setting up SSO requires the portal software to support OAuth2 integration with Google and Microsoft. Some older or simpler portal tools don't offer this. If your portal vendor doesn't, this method is unavailable. Building passwordless into your client portal If your current portal is traditional username + password, the fix depends on