# What is Passwordless Authentication?

> Passwordless authentication verifies a user without requiring that user to supply a reusable password to the target service.

- Canonical URL: https://yellowcube.eu/glossary/passwordless-authentication/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Implementations may use FIDO public-key credentials, smart cards or other PKI credentials, cryptographic devices, or links and codes delivered through another trusted channel. These methods differ substantially in security, usability, and assurance.

Removing the service password eliminates password guessing, reuse, credential stuffing, and theft of that password database as direct attack paths. It does not remove the need for secure enrollment, authenticator binding, recovery, revocation, device replacement, and session management. A service may also be passwordless while the upstream email account, identity provider, or credential-sync account on which it depends still uses a password.

### Key points

- **Evaluate the protocol:** Determine what proves control, how the credential is bound to the legitimate service, and whether an intermediary can replay or redirect it.
- **Evaluate the factors:** Passwordless describes the absence of a password, not the number or independence of authentication factors.
- **Protect lifecycle events:** Registration, account recovery, help-desk actions, lost devices, and fallback methods must not be weaker than routine sign-in.
- **Plan migration:** Inventory unsupported applications, provide accessible alternatives, establish recovery, and retire password fallback when it is no longer required.
- **Important limitation:** Passwordless does not automatically mean multi-factor, phishing-resistant, or high-assurance. Email links, one-time codes, and approval prompts can remain phishable or depend on a compromised channel.

### Related terms

[Passkey](<https://yellowcube.eu/glossary/passkey/>) · [Multi-factor authentication (MFA)](<https://yellowcube.eu/glossary/multi-factor-authentication/>) · [Phishing-resistant authentication](<https://yellowcube.eu/glossary/phishing-resistant-authentication/>) · [Identity and access management (IAM)](<https://yellowcube.eu/glossary/identity-and-access-management/>) · [Account recovery](<https://yellowcube.eu/glossary/account-recovery/>)

### Sources

[NIST SP 800-63B-4: Authentication and Authenticator Management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final) · [CISA and NSA: Identity and Access Management Recommended Best Practices](https://www.cisa.gov/sites/default/files/2023-12/ESF%20IDENTITY%20AND%20ACCESS%20MANAGEMENT%20RECOMMENDED%20BEST%20PRACTICES%20FOR%20ADMINISTRATORS%20PP-23-0248_508C.pdf)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.