Implementations may use FIDO public-key credentials, smart cards or other PKI credentials, cryptographic devices, or links and codes delivered through another trusted channel. These methods differ substantially in security, usability, and assurance.
Removing the service password eliminates password guessing, reuse, credential stuffing, and theft of that password database as direct attack paths. It does not remove the need for secure enrollment, authenticator binding, recovery, revocation, device replacement, and session management. A service may also be passwordless while the upstream email account, identity provider, or credential-sync account on which it depends still uses a password.
Key points
Evaluate the protocolDetermine what proves control, how the credential is bound to the legitimate service, and whether an intermediary can replay or redirect it.
Evaluate the factorsPasswordless describes the absence of a password, not the number or independence of authentication factors.
Protect lifecycle eventsRegistration, account recovery, help-desk actions, lost devices, and fallback methods must not be weaker than routine sign-in.
Plan migrationInventory unsupported applications, provide accessible alternatives, establish recovery, and retire password fallback when it is no longer required.
Important limitationPasswordless does not automatically mean multi-factor, phishing-resistant, or high-assurance. Email links, one-time codes, and approval prompts can remain phishable or depend on a compromised channel.