Are passkeys passwordless?

Yes. Passkeys are the leading passwordless method, based on the W3C WebAuthn and FIDO2 standards. They use public-key cryptography bound to the website's origin, so a phishing site cannot use them. WebAuthn Level 3 became a W3C Recommendation on 25 August 2026.

Is passwordless more secure than passwords?

It depends on the method. Passkeys and security keys are more secure because nothing reusable or typeable leaves the device. Magic links and SMS or email codes remove password reuse and credential stuffing but remain open to real-time phishing relay and, for SMS, SIM swap.

Which companies offer the best passwordless authentication solutions?

For workforce sign-in: Microsoft Entra with Microsoft Authenticator, Okta, Duo (Cisco), Yubico security keys, HYPR, Beyond Identity and 1Kosmos. For customer apps: Auth0 (Okta), Stytch (Twilio since November 2025), Transmit Security, Descope, Clerk and Corbado, plus open-source Hanko. See SWI's passwordless CIAM and phishing-resistant MFA rankings for scored comparisons.

What is the best passwordless option for a B2C mobile app?

Passkeys as the primary method, because iOS and Android sync them and they need no code entry, with a second passkey or verified recovery path instead of SMS fallback. Developer CIAM platforms with passkey support and published free tiers include Auth0 (25,000 MAU free), Stytch (10,000 MAU) and Amazon Cognito (10,000 MAU), checked 30 October 2026.

Is passwordless the same as MFA?

No. Passwordless removes the password; MFA requires two or more factor types. A passkey is both: possession of the device plus a biometric or PIN to use it. A magic link alone is passwordless but single-factor.

What happens if a user loses every passkey device?

They need an account recovery path, and that path sets the real security of the account. Enrol at least two credentials per account, avoid SMS-only recovery, and use identity verification or a help desk process that cannot be satisfied by caller-supplied facts.

What Is Passwordless Authentication? Methods and Providers

Q: What is passwordless authentication?

Passwordless authentication signs a user in without a password they have to remember. The user proves identity with something they have, such as a phone, laptop or security key, confirmed with a biometric or local PIN. Passkeys built on WebAuthn and FIDO2 are the strongest form; magic links and one-time codes also remove the password but can still be phished.

Passwordless authentication verifies a user without a password or other shared secret they must remember: the user proves identity with something they have (a phone, laptop or security key) confirmed by something they are (a biometric) or know (a local PIN). The strongest form is the passkey, built on WebAuthn and FIDO2. Not every passwordless method resists phishing, and that distinction decides most buying choices.

Why move off passwords

Passwords are reused, phished, guessed and leaked, which feeds credential stuffing and password spraying. The pattern is constant in SWI's breach database: about 14,000 23andMe accounts opened with reused passwords exposed profile data on about 6.9 million people, and Roku lost about 591,000 accounts to stuffing in two waves in 2024. Removing the shared secret removes the thing attackers collect.

Adoption is no longer the blocker. The FIDO Alliance said on 15 October 2026 that about 7 billion passkeys are in circulation, that more than a third of successful sign-ins at the 15 services in its Passkey Index now use a passkey, and that passkey sign-ins are nearly three times faster than passwords. Our Passkey Index analysis covers what that means for a rollout.

The passwordless spectrum

Passwordless is a user experience claim, not a security claim. Magic links and emailed one-time codes remove the password and keep the phishability: a real-time relay kit captures the code the user types as easily as it captures a password. Only origin-bound credentials, passkeys and FIDO2 security keys, remove both, because the authenticator refuses to sign for a domain other than the one that registered it.

Method	Removes password	Phishing-resistant	Main weakness
Magic link	Yes	No	Email account takeover, link forwarding
Email or SMS one-time code	Yes	No	OTP relay, SIM swap
Authenticator app code (TOTP)	Only with a second factor	No	Relay, cloud-synced seeds
Push approval	Only with a second factor	No	Push bombing; number matching reduces it
Synced passkey	Yes	Yes	Security of the sync account and recovery
Device-bound passkey or security key	Yes	Yes	Cost and lost-key logistics

NIST draws the same line. In SP 800-63B-4, authenticators that involve manual entry of an output, which includes OTP and out-of-band codes, are not phishing resistant; verifiers must offer at least one phishing-resistant option at AAL2; and AAL3 requires a non-exportable private key, so synced passkeys do not qualify at that level.

What changed in 2025-2026

Standards. WebAuthn Level 3 became a W3C Recommendation on 25 August 2026, and CTAP 2.3 became a FIDO Proposed Standard in February 2026 (see the WebAuthn and FIDO2 standard page).
Platform defaults. Passkeys became the Microsoft Entra ID default on 1 September 2026, and Microsoft stops delivering SMS and voice codes in Entra ID on 1 February 2027 for most users (the SMS off-ramp).
Ownership. Stytch has been part of Twilio since November 2025. Ping Identity signed a definitive agreement to acquire Keyless, a privacy-preserving biometric authentication company, on 30 October 2025. Vercel acquired Better Auth on 7 July 2026; the library stays MIT licensed. See identity acquisitions.
Attacks moved around the cryptography. Three research teams published passkey attacks in August 2026 that targeted event logs, sync key custody and in-session key reuse, all from malware already on the endpoint (passkeys had a hard month, credential manager key extraction).

Passwordless authentication providers

Use case	Providers to shortlist	Pricing signal (checked October 2026)
Workforce, already on Microsoft	Microsoft Entra with Microsoft Authenticator	Entra ID P1 $7, P2 $10 per user per month, paid yearly
Workforce, any IdP	Okta, Duo, HYPR, Beyond Identity, 1Kosmos	Duo free to 10 users, then $3, $6, $9; Okta Starter $6; others quote
Hardware for admins	Yubico	Published per-key prices
Customer apps, developer-led	Auth0, Stytch, Descope, Clerk	Free tiers from 7,500 to 50,000 users
Customer apps, enterprise fraud focus	Transmit Security, Ping Identity	Quote-based
Add passkeys to an existing login	Corbado, Hanko	Hanko free to 10,000 MAU, Pro $29/month

Prices come from the Identity Pricing Transparency Index 2026. For scored comparisons, see the best passwordless CIAM providers, best phishing-resistant MFA, the top passwordless authentication platforms and Duo vs Microsoft Authenticator.

Recovery is the other half of the project

Deleting the password also deletes the fallback everyone quietly relied on, and an insecure recovery path becomes the new weakest link. An account protected by a passkey with SMS recovery is protected by SMS. Coinbase customers learned this in 2021 when attackers abused an SMS account recovery flaw to take over at least 6,000 accounts. At Retool in 2023, Google Authenticator had synced an employee's MFA seeds to a Google account, so one phished account yielded the other factors too.

Three rules hold up: enrol at least two credentials per account, prompt for the second at the first successful sign-in rather than at registration, and be explicit in the UI about what happens when every registered device is gone. For consumer products that usually means identity verification; for workforce it means a help desk process that does not rely on caller-supplied facts (help desk social engineering). See account recovery.

Where to start

Tier users: synced passkeys for the general population, device-bound keys for administrators and production access.
Offer passkeys at sign-in and after recovery, not only in account settings.
Remove the password and SMS fallback for accounts that have two passkeys, rather than leaving them beside the passkey.
Measure passkey sign-in share and recovery volume monthly.

Read Passkeys 101, the passwordless implementation guide and the passwordless strategy guide, check SaaS support in the MFA matrix, and choose a vendor with how to choose an MFA solution.