How I Grew Password Manager Activation 52% Through Iterative User Testing

The Challenge

Transforming a Web-Only Password Manager Into a Native Cross-Platform Experience

The Business Context

At PureSquare (a cybersecurity company with millions of active VPN users), our password manager was opening in a web view, causing security issues and friction in the user's journey. User feedback consistently highlighted critical problems: the web view created security vulnerabilities and users had to deal with additional loading times and context switching every time they needed to manage passwords.

This web view implementation not only compromised security but also created unnecessary complexity that significantly reduced password manager adoption. Users told us they wanted password management capabilities directly integrated into the app they used daily—not through a separate web view.

Defining Success: Working with business stakeholders and analyzing user feedback patterns, we defined our north star metric clearly: Activation = Adding 1st Vault Item. This meant the moment a user successfully saved their first password, credit card, or secure note to the password manager—a clear signal of product adoption and value realization.

My Role as Associate Product Manager II

I led the end-to-end product development from initial discovery through post-launch optimization:

• User Research: Designed and executed 20+ user interviews across 4 iteration rounds
• Cross-Functional Coordination: Aligned design, 4 platform engineering teams, QA, support, and marketing
• Strategic Prioritization: Made critical scoping decisions for Phase 1 vs. Phase 2 features
• Platform Strategy: Determined rollout sequencing—Android/macOS first, then iOS/Windows

Why This Transformation Mattered

Strategic Constraints That Shaped Our Approach

B2C Focus First: We deliberately paused B2B features (organization management, team password sharing) to focus exclusively on consumer use cases. This decision allowed us to:

• Nail the core experience for 90% of our user base (individual consumers)
• Ship approximately 6 weeks faster than a full-feature approach
• Validate product-market fit before expanding scope to business accounts
• Build a solid foundation for future B2B expansion with proven UX patterns

Platform-Specific Complexity: Each operating system presented unique technical constraints—iOS autofill APIs work differently than Android accessibility services work differently than desktop browser extensions. This meant "one design fits all" wouldn't work; we needed platform-specific thinking from day one.

My Approach

Research-Driven Design Meets Strategic Phased Rollout

I structured this 5-month product development journey around three interconnected principles:

Phase 1: Deep User Research (January - February 2025)

Before writing a single line of code or finalizing any design mockups, I invested 6 weeks in comprehensive user research to derisk our assumptions and identify hidden friction points.

From Blockers to Zero Friction: The Research Evolution

The transformation from Round 1 (multiple blockers) to Round 4 (zero blockers) demonstrates the power of systematic, user-driven iteration. Here's what we learned and fixed:

Specific blockers we eliminated between rounds:

• Vault/Organization Confusion (2 users in Round 1-2): Users didn't understand what a "vault" was or why "organizations" existed. Solution: Added tutorial-based onboarding with coach marks that explained vault structure upfront and clarified that organizations are only needed for team password sharing (which we deferred to Phase 2).
• Password Edit Invisibility (4 users in Round 2-3): Users couldn't find the edit button to modify saved passwords. Solution: Made the edit button visible directly overlaid on password text fields (following native OS patterns) rather than hiding it in overflow menus.
• Password Length/Complexity Confusion (1 user in Round 2): User was unsure how to adjust password length or include special characters during generation. Solution: Added prominent toggles for "Include Special Characters" and a length slider with real-time password preview.
• Category Placement Issues (1 user in Round 2): User missed the category dropdown during password creation. Solution: Improved visual hierarchy to make category selection (Login, Credit Card, Bank Account, etc.) more prominent with icon-based visual differentiation.

Phase 2: Strategic Feature Scoping & Prioritization

Armed with user research insights, I made critical scoping decisions to maximize speed-to-market while ensuring a complete-feeling user experience. The key question: "What can users not accomplish their core password management tasks without?"

• Ship faster, learn faster: Get core functionality into users' hands by March rather than waiting until June for feature completeness
• Validate platform-by-platform: Test on Android and macOS first (representing 65%+ of our active VPN users) to catch platform-specific issues before expanding
• Use real activation data to inform Phase 2: Let March/April usage patterns guide which Phase 2 features to prioritize
• Manage cross-platform technical complexity: Each OS has unique constraints (iOS autofill APIs ≠ Android accessibility services ≠ desktop browser extensions), so one-size-fits-all design was never going to work

Phase 1 MUST HAVEs (Shipped March 2025):

• Master Password Setup: Security foundation—users cannot access their password vault without first creating a master password. Non-negotiable for password manager functionality.
• Core CRUD Operations: Create, read, update, delete for multiple item types (passwords/logins, credit cards, bank accounts, secure notes). This is table stakes—users need to manage their credentials.
• Password Generator: Security best practice feature that helps users create strong, unique passwords (addresses the core use case: "I want secure passwords but don't know how to create them").
• Cross-Device Sync: Fundamental cross-platform expectation—users want their passwords accessible on every device they use (phone, laptop, tablet).
• Category Support: Basic organization system (Login, Credit Card, Bank Account, Note categories) to help users mentally organize different credential types.

Phase 2 NICE TO HAVEs (Shipped April-June 2025):

• Autofill Password: Convenience layer for mobile apps and browsers. While valuable, users can still manually copy-paste passwords if autofill isn't available yet.
• Auto-Lock Timer: Security preference for security-conscious users who want automatic vault locking after inactivity. Nice-to-have but not blocking core workflows.
• Organization Visibility (B2B Feature): Team password sharing and organization management. Deliberately deferred because only ~10% of users are business accounts—we optimized for the 90% consumer majority first.
• Mark as Favorite: Power user shortcut for quickly accessing frequently-used passwords. Useful but not essential for first-time users learning the product.
• Dashboard Quick Actions: Efficiency optimizations like duplicate password, edit from home screen, recently used items. These enhance existing workflows but aren't needed to complete core tasks.

The Strategic Payoff: By ruthlessly prioritizing Phase 1 features, we shipped a complete-feeling product in March rather than waiting until June for "everything." Users got immediate value; we got immediate feedback to validate our approach before committing significant engineering resources to Phase 2 development.

Phase 3: Phased Platform Rollout Strategy

Rather than attempting a simultaneous 4-platform launch (high risk of fragmentation and platform-specific bugs derailing everything), I designed a sequential rollout strategy that maximized learning while minimizing risk.

Key Strategic Decisions That Shaped Success

• B2C First, B2B Later (Scope Constraint): We intentionally paused organization-specific features (team password sharing, access controls, admin dashboards) to nail the consumer experience for 90% of our user base. This singular focus allowed us to ship approximately 6 weeks faster and validate core flows with the majority of users before expanding scope to business accounts. Several B2B prospects reached out after our "Cyber Security News" feature, validating future expansion opportunity.
• Platform Prioritization Based on User Distribution: Started with Android (mobile-first, younger demographic, larger absolute user count) and macOS (power users, higher engagement rates) representing 65%+ of active VPN users. This sequencing maximized initial impact and feedback volume before tackling iOS (design-conscious users with high expectations) and Windows (enterprise-heavy, desktop workflows).
• Platform-Specific Feature Decisions Over Forced Parity: Rather than demanding identical features across all platforms (which would have delayed shipping), we tailored each platform intelligently. Web kept biometric lock + "Mark as Trusted Device" (useful for desktop workflows where users work on the same machine daily). Mobile apps got quick actions like duplicate/favorite/share (mobile users value speed and shortcuts). iOS received password generator during setup flow (our research showed iOS users were more security-conscious and wanted strong passwords from day one).
• Continuous Post-Launch Optimization: Rather than treating June as "done" and moving on, we established ongoing feedback loops through customer support ticket tagging, in-app NPS surveys (shown after 7 days of usage), and monthly user interviews with activated users. This surfaced issues like iOS master password recovery flow confusion, which we fixed in July with better onboarding tooltips.
• Product Marketing Coordination for Maximum Impact: Deliberately timed the full 4-platform launch (June) with Product Marketing's social media campaign to amplify awareness beyond our existing VPN user base. This coordination resulted in: (1) LinkedIn feature on "Cyber Security News" (external credibility), (2) cross-platform social media visibility (Instagram, Twitter, LinkedIn), and (3) inbound B2B interest from prospects who discovered us through press coverage.

Results & Impact

52% Peak Growth, 71% Total Growth & Industry Recognition

The Complete Growth Story: Month-by-Month

Here's the detailed activation trajectory that tells the story of how systematic product development drives compounding growth:

• November 2024 - February 2025 (Pre-Launch Baseline): ~105-140 unique activations per month with the legacy web-only experience. Users had to leave the VPN app, open their browser, navigate to the password manager web portal, and log in separately—creating significant friction that suppressed adoption.
• March 2025 (Android/macOS Phase 1 Launch): ~135 activations, representing an 8.2% increase versus February baseline of ~125. The in-app experience immediately reduced friction—users could now access password management without leaving the app they used daily. This validated our core hypothesis: reducing context-switching would drive adoption.
• April 2025 (Phase 2 Feature Expansion): ~138 activations, an additional 2.27% increase versus March. Adding Phase 2 features (autofill, favorites, dashboard quick actions) enhanced the value proposition for power users and addressed feedback from early adopters about missing convenience features. The incremental gain proved that feature enhancement compounds on top of the foundational in-app experience.
• May 2025 (Pre-iOS/Windows Plateau): Slight plateau back to ~135 activations as we prepared infrastructure for the full platform launch. Interestingly, customer support received feedback from users explicitly saying they were "waiting for iOS" before committing to the password manager—validating our decision to complete platform coverage.
• June 2025 (Full Platform Launch + Marketing): ~205 activations—a 52% increase versus May and 71% total growth from baseline. This was the hockey-stick inflection point where multiple factors aligned: iOS launch (design-conscious users adopted at higher rates), Windows Phase 2 (enterprise users on desktops), Product Marketing's social media campaign (amplified awareness beyond existing VPN users), and "Cyber Security News" LinkedIn feature (external validation that drew inbound interest).

What Drove the June Hockey-Stick Inflection?

The 52% month-over-month spike in June wasn't a single-variable outcome—it resulted from multiple strategic factors aligning simultaneously:

• iOS Launch Brought Design-Conscious Users: iOS users historically show higher engagement with security and privacy features in our VPN product. Our user research validated that iOS users were more willing to adopt password managers if the UX felt native and polished. By shipping iOS with both Phase 1 + Phase 2 features (learning from Android/macOS feedback), we delivered a premium experience that met their elevated expectations.
• Full Cross-Platform Coverage Removed "Waiting" Friction: In May, customer support logs showed users explicitly saying "I'll wait for iOS before I start using this" or "Let me know when Windows has this feature." These users were interested but wouldn't commit until all their devices were covered. June's simultaneous 4-platform availability removed all platform objections and unlocked this latent demand.
• Product Marketing Amplification Expanded Reach: Our coordinated social media campaign (LinkedIn thought leadership posts, Twitter product announcements, Instagram visual showcases) drove awareness beyond our existing VPN user base. The campaign also caught the attention of "Cyber Security News," which featured us on LinkedIn—creating credibility signaling and attracting inbound B2B interest from prospects who discovered us through press coverage rather than being existing VPN users.
• Network Effects from Early Adopters: March/April adopters (early Android/macOS users) became advocates who shared their positive experiences with friends, family, and coworkers. We saw evidence of this in support tickets referencing "my friend told me about this" and social media mentions tagging others.

What Made This Product Launch Successful

• Phased Rollout: Validated on Android/macOS first (65% of users), then expanded to iOS/Windows. This prevented platform-specific issues from derailing the entire launch.
• Strategic Scoping: Prioritized Phase 1 MUST HAVEs to ship in March versus waiting until June for full feature parity. Users got value 3 months earlier; we got feedback 3 months earlier.
• Platform-Specific Design: Designed for each platform's native patterns rather than forcing one-size-fits-all. Web kept biometric lock, mobile got quick actions, iOS prioritized password generator during setup.
• Marketing Timing: June's spike came from platform coverage + feature maturity + marketing + press coverage compounding together.

Key Learnings

What I Learned as a Product Manager

Technical & Product Learnings

• Cross-Platform Requires Platform-Specific Thinking, Not Templates: iOS's autofill API limitations forced us to redesign our password entry flow 3 times before finding an approach that felt native and didn't violate App Store guidelines. I learned that technical constraints should inform UX decisions from day one, not as afterthoughts. Involving iOS engineers in early design reviews (even before finalizing mockups) saved us approximately 2 weeks of rework and prevented a rejected App Store submission. Each platform has its own "opinion" about how features should work—respect that opinion rather than fighting it.
• Internal Stakeholder Research Is As Valuable As External User Research: Our cross-functional team interviews surfaced critical institutional knowledge that shaped our Phase 1/2 scoping decisions: Engineering knew Android's accessibility permissions were a historical support burden (informed our decision to improve permission request UX). Customer support knew users frequently forgot master passwords (informed our decision to prioritize recovery flow UX). Design knew iOS review guidelines prohibited certain biometric patterns (prevented wasted design work on non-compliant approaches). Don't skip internal research—your team has battle scars worth learning from.
• Hockey-Stick Growth Requires Multiple Ingredients Aligning Simultaneously: The June spike came from (1) iOS platform coverage, (2) Phase 2 feature maturity, (3) Product Marketing's campaign, (4) press coverage from "Cyber Security News," and (5) word-of-mouth from early March/April adopters all compounding together. Single-variable thinking ("we just need iOS and growth will happen") underestimates what drives breakout growth. As a PM, my job isn't just building features—it's orchestrating multiple levers (product quality, platform coverage, marketing timing, press outreach, community building) to create compounding effects.
• Strategic Scoping Decisions Compound Over Time: Pausing B2B organization features allowed us to ship B2C 6 weeks faster → which gave us activation data sooner → which informed better prioritization for what to build next → which created product momentum → which attracted "Cyber Security News" press attention → which generated inbound B2B interest anyway. Strategic constraints enable focus, focus enables speed, speed enables learning, learning enables better decisions. Saying "no" to B2B initially created more B2B opportunity later because we built a better foundation.
• "Zero Blockers" Is the Bar for Shipping, Not Perfection: By Round 4 of user testing, users completed all tasks without assistance—that was our green light to ship Phase 1 in March, even though there were many nice-to-have improvements we could have made (better password strength indicators, password breach checking, custom categories, etc.). Perfectionism delays learning. Ship when blockers are eliminated and core workflows are smooth, then iterate based on real usage patterns. We shipped in March with Phase 1, learned from April usage, and delivered a better Phase 2 in June because we had 3 months of real feedback to inform priorities.

Process & Collaboration Learnings

• User Research Saves More Time Than It Costs: The 6 weeks we invested in user research (20+ interviews across 4 rounds) felt "slow" in the moment, especially when engineering was eager to start building. But those 6 weeks prevented at least 3-4 months of post-launch iteration to fix fundamental UX issues. For example, if we hadn't discovered the vault/organization confusion in early rounds and shipped with confusing terminology, we would have faced: (1) high support ticket volume requiring FAQ creation and support team training, (2) poor activation rates requiring redesign work, (3) negative App Store reviews hurting discoverability. Research isn't overhead—it's insurance against expensive mistakes.
• Phased Rollouts Create Psychological Safety for Teams: By shipping Android/macOS first (March) rather than all 4 platforms simultaneously, we gave our engineering teams psychological safety to experiment and learn without the pressure of a massive coordinated launch. Android engineers could try accessibility permission UX improvements in March, see support ticket impact in April, and share learnings with iOS engineers before their June launch. This knowledge transfer across platform teams (via weekly cross-platform syncs and shared Slack channels) made the June launch smoother because iOS/Windows teams learned from Android/macOS battle scars.
• Product Marketing Coordination Matters More Than PMs Realize: I initially underestimated how much impact coordinated Product Marketing could have on activation numbers. The June spike proved that product quality enables marketing impact, but marketing amplifies product reach. Without the social media campaign and press outreach, our iOS launch would have been discovered organically over several months rather than creating a concentrated activation spike. As a PM, I learned to involve Product Marketing early (in this case, April planning for June launch) to align on messaging, identify PR opportunities, and coordinate timing for maximum impact.
• Support Tickets Are Product Research, Not Just Customer Service: We established a system where customer support tagged all password manager tickets with specific categories (onboarding confusion, feature requests, bugs, etc.). Analyzing these tags monthly revealed patterns that informed our continuous optimization roadmap. For example, iOS users disproportionately submitted tickets about master password recovery confusion—this pattern prompted the July UX improvement. Support tickets are free user research if you build systems to categorize and analyze them systematically.