Passwordless authentication is a type of multi-factor authentication (MFA) that eliminates a password as an authentication type. Instead of using passwords (something the user knows), passwordless authentication relies on authenticating a user via other means, such as something a user has (like a trusted mobile device or a hardware security key) and something that they are (for example, scanning their fingerprint).
The most common use cases for passwordless authentication include either workforce (employee) authentication or customer authentication. Companies use passwordless authentication to improve end user experience, as many people forget or reuse unsecured passwords; reduce security risks to the company stemming from breached passwords; and reduce the cost of maintaining passwords and lifting the burden of password resets on help desk teams.
For a product to be added to the Passwordless Authentication category, the product must authenticate a user via FIDO-compliant authenticator apps, security keys/cards, or similar technology. To be added to this category, a product cannot rely on email or SMS-based authentication as its main form of authentication, as these methods are susceptible to hacks. Similarly, a product cannot merely provide password replay; it must provide a truly passwordless solution. Some products may complement their FIDO-compliant authenticator with biometric authentication. Additionally, products may offer fallback methods including voice, email, or SMS-based authentication, but that should be a feature a company can choose to offer if the end user is offline and does not have access to cellular data or networks when using a mobile device (vs. using a hardware security key).
Depending on the use case, passwordless authentication works with a company’s identity and access management (IAM) software or customer identity and access management (IAM) software.
To qualify for inclusion in the Passwordless Authentication Software category, a product must:
Prompt users to authenticate when logging in
Authenticate users with a FIDO-compliant authenticator app or security key
Offer users multiple ways to authenticate including, but not limited to: mobile push on trusted devices; FIDO-enabled devices; physical security keys; keycards; smart watches; biometrics; QR codes; and desktop app and PIN
