What it means
Passwordless is a broad design category rather than one assurance level. Some methods, especially FIDO-based public-key credentials, resist phishing and credential replay. Others, such as email links or SMS codes, remove password entry but still depend on the security of a delivery channel and may remain phishable.
How it works
A deployment must protect initial enrollment, authenticator binding, recovery, device replacement, help-desk processes, and session management. The system should evaluate which authenticators meet the required assurance and threat model rather than selecting solely for convenience.
A workforce application uses a device-bound cryptographic key unlocked by a local PIN. The user enters no password, and the server validates a signed challenge. A separate email-link login may also be passwordless but offers different resistance to account takeover.
Practical focus
- Choose methods based on phishing resistance and required assurance
- Harden enrollment, recovery, and authenticator replacement
- Maintain accessible alternatives that do not weaken privileged access
- Measure account-takeover and support outcomes after migration
Common mistakes
- Assuming passwordless automatically means multifactor or phishing-resistant
- Keeping a weak password as a universal fallback
- Ignoring shared devices, break-glass accounts, and offline access
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: