Passwordless
Authentication without a password as a primary factor. Implementations include magic links, OTP codes, and passkeys. Passkeys are the only passwordless method that is also phishing-resistant.
Passwordless is a user-experience claim, not a security claim, and the two get conflated constantly. Emailed links and one-time codes remove the password and keep the phishability; passkeys remove both. The other half of any passwordless project is recovery, because deleting the password also deletes the fallback everyone quietly relied on, and an insecure recovery path becomes the new weakest link.
See also: what is passwordless, passkey, magic link, CIAM vendors
Related on Start with Identity
- GlossaryPhishing-Resistant MFA
Multi-factor methods that cannot be relayed or replayed by a phishing site, principally FIDO2 security keys and passkeys. Recommended by NIST and CISA over OTP
- GlossaryFIDO2
FIDO2 is a set of specifications from the FIDO Alliance plus W3C. It combines WebAuthn (the browser API) with CTAP (the client-to-authenticator protocol) to ena
- CVEStrongKey FIDO Server credential-type confusion, passkey bypass
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High.
- CVEWindows stores WebAuthn assertions in cleartext event logs
The Windows Event Logging Service wrote WebAuthn assertions in the clear, readable by unprivileged or remote users. SpecterOps / Grafnetter chained it at Black
- GlossaryMFA
Multi-Factor Authentication. Requiring two or more factors from distinct categories: something you know (password), something you have (token), something you ar
- RankingBest Passwordless CIAM Providers: Top 5 Platforms
The best passwordless CIAM providers in 2026: Stytch, Auth0, MojoAuth, Transmit Security, and Ping Identity. Ranked for passkeys, WebAuthn, magic links, and phi