Passwordless authentication

Passwordless authentication is an <a href="/facts/Authentication/64y4S69b">authentication</a> method in which a <a href="/facts/User_(computing)/zQRzG0KG">user</a> can log in to a computer system without entering (and having to remember) a <a href="/facts/Password/WEoul230">password</a> or any other knowledge-based <a href="/facts/Shared_secret/ATRz7LXy">secret</a>. In most common implementations users are asked to enter their public identifier (username, phone number, email address etc.) and then complete the authentication process by providing a secure proof of identity through a registered device or token.
Passwordless authentication methods typically rely on <a href="/facts/Public-key_cryptography/gowoFTxS">public-key cryptography</a> infrastructure where the public key is provided during registration to the authenticating service (remote server, application or website) while the private key is kept on a user’s device (<a href="/facts/Personal_computer/koaYfNce">PC</a>, <a href="/facts/Smartphone/cSIrBMWG">smartphone</a> or an external <a href="/facts/Security_token/0V55fErB">security token</a>) and can be accessed only by providing a <a href="/facts/Biometric_signature/MgTbyA0r">biometric signature</a> or another authentication factor which is not knowledge-based. 
These factors classically fall into two categories: 

<ul><li>Ownership factors (“Something the user has”) such as a <a href="/facts/Cellular_phone/H3EcqD9h">cellular phone</a>, <a href="/facts/OTP_token/qqqLoB8h">OTP token</a>, <a href="/facts/Smart_card/K7b9lowS">smart card</a> or a <a href="/facts/Hardware_token/0V55fErB">hardware token</a>.</li>
<li>Inherence factors (“Something the user is”) like <a href="/facts/Fingerprint/5WLcd20T">fingerprints</a>, <a href="/facts/Retinal_scan/aNKH8sU8">retinal scans</a>, <a href="/facts/Face_recognition/mtVxaDln">face</a> or <a href="/facts/Speaker_recognition/9Td6nPY7">voice recognition</a> and other biometric identifiers.</li></ul>
Some designs might also accept a combination of other factors such as <a href="/facts/Geo-location/fXux5RaJ">geo-location</a>, <a href="/facts/Network_address/W7RQVwBr">network address</a>, <a href="/facts/Behavioral_patterns/bj6GXvaL">behavioral patterns</a> and <a href="/facts/Gesture_recognition/jly3YdnY">gestures</a>, as long as no memorized passwords are involved.
Passwordless authentication is sometimes confused with <a href="/facts/Multi-factor_authentication/186gpx8R">multi-factor authentication</a> (MFA), since both use a wide variety of authentication factors, but while MFA is often used as an added layer of security on top of password-based authentication, passwordless authentication does not require a memorized secret and usually uses just one highly secure factor to authenticate identity (i.e., an external security token), making it faster and simpler for users.
"Passwordless MFA" is the term used when both approaches are employed, and the authentication flow is both passwordless and uses multiple factors, providing the highest security level when implemented correctly.

Passwordless authentication open-in-new

Passwordless authentication