The Login Tax: I Timed Every Sign-In for a Week and It Cost Me Over an Hour

Nobody budgets for authentication. It's a blink here, a code there, a quick "remind me later" when the reset email shows up. It feels free because the cost is paid in two-second installments.

So I decided to invoice myself. For five working days in early November, I logged every single authentication event — every sign-in, every two-factor prompt, every password reset, every time a corporate SSO check bounced me to a page I didn't expect. Start time when the login prompt appeared, end time when I was actually inside.

What counted as the login tax

I kept it strict. Anything that stood between me and a working session was taxed:

• Typing passwords
• Retrieving and entering 2FA codes, or waiting for a push notification to arrive
• Password resets and the associated email archaeology
• SSO redirects, re-authentication detours, and the classic "session expired" bounce
• Time spent hunting for which account I'd used for a specific service

I did not count the time it took to set up a password manager or enroll in 2FA. That's an investment, not a tax. Fair is fair.

The damage

Across five workdays, I went through 112 authentication events. That's a little over 22 per day, which sounds absurd until you remember that a normal Tuesday includes email, chat, the project tracker, the design tool, the expense system, two banking portals, and a vendor site you logged into once in March.

Total time: 1 hour and 11 minutes.

Put another way: about 20 minutes a day, or roughly one full workday every five weeks. That's not a rounding error. That's a recurring meeting nobody put on the calendar.

Here's where it went:

• Waiting for push notifications — 27%. The single biggest bucket, and the most insulting one. The prompt arrives fast enough to make you wait, slow enough to make you annoyed.
• Typing or pasting credentials — 24%. Long tail of small stuff. Fifteen seconds here, thirty there.
• SSO and re-auth detours — 21%. Corporate single sign-on saves you from remembering passwords and then charges you in redirects.
• Password resets — 17%. Eighteen of them, including three in one afternoon on the same service, which is its own story.
• Account archaeology — 11%. Figuring out whether I use the work email or the personal one, then failing, then trying the other.

The friction nobody designs for

Two findings surprised me.

First, the resets weren't caused by forgetting. Most happened because of device changes, session policy expirations, or a service that quietly stopped accepting my saved credential. I wasn't careless. I was being evicted.

Second, latency is worse than typing. I would happily type a 20-character passphrase if it meant no waiting. A push prompt that takes eight seconds to land costs more than twenty seconds of typing, because it hijacks attention. The tax isn't just time — it's the context switch on either side of it, which my stopwatch didn't even capture.

So I tested the fixes

I spent the second half of the week running two changes and comparing.

Test A: password manager with autofill plus passkeys wherever offered. Twenty-two of my regular services supported passkeys. I enrolled in all of them. Everything else went into the manager with autofill enabled at the browser level.

Test B: consolidating the SSO detours. I mapped which services actually needed separate accounts versus which could ride on federated login, and I killed the duplicates where policy allowed.

Results over the second half of the week: authentication time dropped from roughly 20 minutes a day to about 7 minutes. That's a two-thirds cut, without disabling a single security control.

Passkeys did the heavy lifting where they were available — the biometric prompt is essentially one gesture, and there's no code to wait for. The password manager covered the long tail. The steady-state number I'd estimate going forward is around 25 minutes a week instead of 71.

The plan, if you want your hour back

1. Audit before you optimize. Log your own authentications for two days. Most people assume their friction comes from typing passwords. For me it was waiting, and the fix was completely different.
2. Turn on passkeys first. Any service offering them — email, banking, shopping, social — should be migrated before you touch anything else. Highest return per minute of setup.
3. Use one password manager, and let it autofill. A manager you have to fight is a manager you'll abandon.
4. Kill duplicate accounts. If a service supports federated login through an identity provider you already trust, use it. Every retired account is a reset you'll never have to do.
5. Fix the reset triggers, not the resets. If you're resetting weekly, the problem is a device, a policy, or a stale saved credential — not your memory.
6. Batch your re-authentication. If a session expires on a predictable schedule, do the bounce at the top of the day rather than mid-task, where it'll cost you double in lost focus.

What not to cut

A little restraint here. Some of the friction is load-bearing.

Don't turn off two-factor to save eight seconds. Don't reuse passwords because it makes the typing faster. Don't disable an authenticator app in favor of SMS because the code arrives sooner. Every genuine security downgrade buys you a couple of minutes and costs you your whole weekend if it goes wrong.

The goal isn't zero friction. It's paying for security once, in bulk, at setup — and then not getting nickel-and-dimed every time you sit down to work.