# What Is Passwordless Authentication?

Source: https://startwithidentity.com/guides/fundamentals/what-is-passwordless/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Passwordless authentication verifies a user without a shared secret they have to remember. Instead of a password, the user proves identity with something they have (a device or security key) and something they are (a biometric) or know (a local PIN). Done well, it is both more secure and easier than passwords.

## Why move off passwords

Passwords are the largest single source of breaches through reuse, phishing, [credential stuffing](https://startwithidentity.com/glossary/credential-stuffing/), and [password spraying](https://startwithidentity.com/glossary/password-spraying/). Removing the shared secret removes the thing attackers steal.

## The passwordless spectrum

Not all passwordless is equal:

- **Phishing-resistant:** [passkeys](https://startwithidentity.com/guides/authentication/passkeys-101/) and [FIDO2](https://startwithidentity.com/glossary/fido2/) security keys, bound to the origin and impossible to replay. The gold standard.
- **Better than passwords but phishable:** [magic links](https://startwithidentity.com/glossary/magic-link/) and email or SMS [one-time codes](https://startwithidentity.com/glossary/totp/).

Aim for [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) where it matters.

## Practical considerations

Plan for enrollment and account recovery, the steps attackers target once passwords are gone. Support more than one authenticator per user, and have a tested fallback.

## Passwordless is a UX claim, not a security claim

This is the distinction that matters and the one marketing collapses. [Magic links](https://startwithidentity.com/glossary/magic-link/) and emailed one-time codes remove the password and keep the phishability: a real-time relay kit captures the code the user types just as easily as it captures a password. Only origin-bound credentials, [passkeys](https://startwithidentity.com/glossary/passkey/) and FIDO2 security keys, remove both, because the authenticator refuses to sign for a domain other than the one that registered it.

Rank the options honestly:

| Method | Removes password | Phishing-resistant |
|---|---|---|
| Magic link | Yes | No |
| Email or SMS one-time code | Yes | No |
| Authenticator app code ([TOTP](https://startwithidentity.com/glossary/totp/)) | Only with a second factor | No |
| Push approval | Only with a second factor | No |
| Passkey or security key | Yes | Yes |

## Recovery is the other half of the project

Deleting the password also deletes the fallback everyone quietly relied on, and an insecure recovery path becomes the new weakest link. An account protected by a passkey with SMS recovery is protected by SMS.

Three rules that hold up: enrol at least two credentials per account, prompt for the second at the first successful sign-in rather than at registration, and be explicit in the UI about what happens when every registered device is gone. For consumer products that usually means [identity verification](https://startwithidentity.com/glossary/idv/); for workforce it means a help desk process that does not rely on caller-supplied facts.

## What the 2026 research changed

Three research teams published passkey attacks in August 2026, and none of them broke the cryptography: they attacked event logs, sync key custody, and in-session key reuse, all starting from malware already on the endpoint. The practical consequence is tiering rather than retreat. Synced passkeys for consumers, device-bound hardware authenticators for administrators and production access. See [passkeys had a hard month](https://startwithidentity.com/blog/passkeys-first-hard-month/).

## Where to start

Read [Passkeys 101](https://startwithidentity.com/guides/authentication/passkeys-101/) and browse [MFA and passwordless vendors](https://startwithidentity.com/vendors/mfa/).