Scan to join WeChat groupTrust and Recovery
Trust is built through predictability and tested through failure. Users trust systems that behave consistently and recover gracefully when things go wrong.
Evidence Tiers
[Research] — Peer-reviewed studies, controlled experiments
[Expert] — Nielsen Norman Group, recognized UX authorities
[Case Study] — Documented examples from major products
[Convention] — Industry practice, limited formal validation
Multiple tags = stronger evidence: [Research][Expert]
Mixed findings noted as: [Research — Mixed]
Research Foundations
Peak-End Rule
[Research][Expert] Daniel Kahneman's research (Nobel Prize in Economics, 2002) established that people judge experiences based on:
- The peak moment (most intense, positive or negative)
- The end (how it concluded)
They do not average the entire experience.
UX implication: A single graceful recovery can redeem an otherwise frustrating experience. Don't let the last interaction be an error.
Source: Kahneman, D. (1999). Objective happiness. In Well-being: Foundations of hedonic psychology.
Loss Aversion
[Research][Expert] Kahneman & Tversky's Prospect Theory showed losses feel approximately 2x as painful as equivalent gains feel good.
UX implication: Users are highly motivated to avoid losing their work. Auto-save, undo, and data preservation are disproportionately important.
Source: Kahneman, D. & Tversky, A. (1979). Prospect Theory: An Analysis of Decision under Risk.
Undo vs. Confirmation Dialogs
[Expert] Nielsen Norman Group and multiple UX authorities recommend undo over confirmation dialogs in most cases.
Why Confirmation Often Fails
[Expert] From NNg and practitioner observation:
- Users habitually click "OK" without reading
- Frequent confirmations train users to ignore them
- Confirmations interrupt flow
When to Use Each
| Approach | Use When | Evidence | |----------|----------|----------| | Undo | Action is reversible | [Expert] NNg | | Confirmation | Action is truly irreversible AND destructive | [Expert] NNg | | Neither | Routine, low-risk actions | [Convention] |
[Case Study] Google Drive: No confirmation for moving files to trash (reversible). Confirmation required for emptying trash (irreversible).
Pattern: Undo Toast
[Convention]
[User clicks delete]
[Item disappears immediately]
[Toast: "Item deleted" [Undo] — auto-dismisses in 10s]
Caution: No controlled studies directly comparing undo vs. confirmation outcomes found. This is strong expert consensus, not validated research.
Source: Nielsen Norman - Confirmation Dialogs
Error Message Design
[Expert] Nielsen's Heuristic #9: "Help users recognize, diagnose, and recover from errors."
The Three Questions
Every error message should answer:
- What happened? (Clear description)
- Why? (Cause, if helpful)
- What now? (Recovery path)
Useless:
Error 500: Internal Server Error
Actionable:
Couldn't save your changes — the server is temporarily
unavailable. Your draft has been saved locally.
[Try again] [Continue editing]
[Research] Cognitive Load Theory (Sweller) supports this: vague errors increase extraneous cognitive load.
Source: Nielsen Norman - Error Message Guidelines
Core Patterns
trust-1: Confirm Destructive, Not Routine
[Expert] Only interrupt for truly irreversible actions.
Over-confirming (trains users to ignore):
"Are you sure you want to save?"
"Are you sure you want to go back?"
Appropriate confirmation:
"Delete 47 files permanently? This cannot be undone."
[Cancel] [Delete]
trust-2: Preserve Data Aggressively
[Research] Loss aversion (Kahneman & Tversky) explains why losing work is disproportionately frustrating.
Trust-breaking:
[User writes long comment]
[Accidentally navigates away]
[Returns — comment gone]
Trust-building:
[User writes long comment]
[Accidentally navigates away]
[Returns — draft restored]
Auto-save drafts. Preserve form state. Cache locally.
trust-3: Degrade Gracefully
[Convention] Isolate failures. Don't let one problem cascade.
Brittle:
[One image fails to load]
[Entire page shows error]
Graceful:
[One image fails to load]
[Placeholder shown with retry option]
[Rest of page works fine]
trust-4: Show System Status
[Expert] Nielsen's Heuristic #1: "Visibility of system status."
Opaque:
[User clicks Submit]
[Nothing happens for 3 seconds]
[Suddenly: "Submitted!"]
Transparent:
[User clicks Submit]
[Button shows spinner: "Submitting..."]
[Button changes: "✓ Submitted"]
Recovery Patterns
Pattern: Optimistic UI with Rollback
[Convention]
1. User takes action
2. UI updates immediately (optimistic)
3. Server request in background
4. If success: done
5. If failure: rollback UI + show error + offer retry
Pattern: Forgiving Input
[Expert] Postel's Law: "Be liberal in what you accept."
// Rigid
Phone: [Must be exactly ###-###-####]
// Forgiving
Phone: [Accepts any format, normalizes internally]
"5551234567" → displays as "(555) 123-4567"
Pattern: Graceful Timeout
[Convention]
[Operation takes too long]
"This is taking longer than expected.
You can keep waiting or try again."
[Keep waiting] [Cancel and retry]
Don't make users guess if something is frozen.
Anti-Patterns
| Pattern | Why It Breaks Trust | Evidence | |---------|---------------------|----------| | Silent failures | User doesn't know something went wrong | [Expert] NNg | | Generic errors | No path to recovery | [Expert] NNg | | Lost form data | Punishes user for system failure | [Research] Loss aversion | | Inconsistent behavior | Can't build mental model | [Expert] Jakob's Law | | Hidden data usage | Feels deceptive | [Convention] |
Key Sources
- Kahneman, D. & Tversky, A. (1979). Prospect Theory.
- Kahneman, D. (1999). Objective happiness (Peak-End Rule).
- Sweller, J. (1988). Cognitive load during problem solving.
- Nielsen Norman - Confirmation Dialogs
- Nielsen Norman - Error Message Guidelines
- A List Apart - Never Use a Warning When You Mean Undo