Passwordless authentication

Passwordless authentication is any sign-in method that establishes who a user is without asking for a password. Nothing about the password is improved along the way: no rotation schedule, no minimum length, no better hashing algorithm. The credential is deleted from the design, and another kind of proof inherits its responsibilities.

The distinction that matters is the shape of the secret. A password is a shared secret, so two copies exist: one in a person's head and one on a server. Anything that reads either copy becomes the user. A passwordless credential is held in one place, is usually bound to one device, and is generally something the user could not hand over even if asked to.

That last property is the reason the category exists. Most credential theft today does not break cryptography. It asks a person for something, and the person complies. A method with nothing to hand over ends that conversation before it starts.

Under the branding, the methods share one structure. A server issues a fresh challenge, hardware the user controls produces an answer, and the server compares that answer against material recorded at enrollment. Whatever produced the answer stays where it was created.

Two variables separate one method from the next: what kind of proof gets produced, and how tightly that proof is bound. Together they account for almost all of the security difference between one passwordless product and another.

The security case and the operations case point the same direction here, which is unusual in identity work. Verizon's Data Breach Investigations Report puts credentials in 28 percent of breaches in its 2026 edition, and the same body of research finds a median time-to-click on a phishing message of under sixty seconds. The password is not one weak link among many; it is the link most incidents are built around.

The operational return arrives first and is easier to measure. For most identity teams the reset queue is the single largest source of tickets, and it begins falling within weeks of the first cohort moving across rather than at the end of the program.

Passwordless names a category, not an assurance level. Every method listed here removes the password, and they do not stop the same attacks. Buying by category instead of by property is how an organization ends up with a modern login screen and last year's incident report.

Choose against the specific attack the project exists to stop. Where losses come from phishing and account takeover, only the device-bound and origin-bound methods alter the outcome. Where the driver is support cost, the weaker methods still repay their deployment.

• FIDO2 and passkeys: a key pair created for one relying party and unlocked locally on the authenticator.
• On-device biometrics: a face or fingerprint check that releases a device-bound key.
• Magic links: a single-use URL delivered to a registered email address.
• One-time codes: a numeric value from an authenticator app, an email, or an SMS message.
• Backchannel approval: the sign-in is confirmed on a separate enrolled device, away from the browser.

SenseCrypt is a passwordless identity provider from Seventh Sense. A user is enrolled from a photograph the organization already holds, and from then on signs in with a live face check on their enrolled phone. No password is set during enrollment, and none sits behind the face check. That is a decision rather than an omission: any fallback password reinstates the exact credential the architecture was built to eliminate, and it is the first thing an attacker looks for.

Three sign-in methods exist. Simple QR shows a code on the screen the user wants to open, and the face scan happens in the companion mobile app, where the liveness check and the comparison are both performed on the handset the user enrolled. The passkey method uses real FIDO2/WebAuthn passkeys (ES256) through a roaming authenticator app, and that is the phishing-resistant path, because WebAuthn binds each assertion to the calling site's origin. Simple Webcam runs the face scan from a webcam on a trusted customer network; it is available to enterprise customers, contact sales@seventhsense.ai. This licensed on-premises method processes captures inside the customer deployment and does not add an enrolled-phone possession factor.

The companion app on the enrolled phone is part of the design in the two mobile methods, not an optional extra. What carries no enrollment is the target: the browser, kiosk, desktop or shared terminal being signed in to holds nothing, registers nothing, and can be a machine the user has never touched before.