The password problem
Passwords are broken. We’ve known this for years, but the numbers keep getting worse:
- 80% of data breaches involve stolen or weak credentials (Verizon DBIR 2025)
- The average person manages 100+ passwords — and reuses them across services
- Phishing attacks increased sharply in 2025 compared to 2023
- MFA fatigue attacks (push notification bombing) bypass traditional 2FA
- Password resets cost organizations significant helpdesk time
The industry’s answer? Eliminate passwords entirely.
What is passwordless authentication?
Passwordless authentication replaces passwords with stronger, more convenient verification methods:
1. Biometrics
How it works: Your fingerprint, face, or iris is your credential. The biometric data never leaves your device — only a cryptographic proof is sent to the server.
Examples: Apple Face ID, Windows Hello, Android fingerprint.
Pros: Fast, convenient, hard to steal. Cons: Requires compatible hardware, privacy concerns, can’t be changed if compromised.
2. FIDO2 / WebAuthn Security Keys
How it works: A physical USB/NFC device generates a unique cryptographic key pair for each service. The private key never leaves the device. Authentication requires physical possession + a gesture (touch the key).
Examples: YubiKey 5, Google Titan, Feitian.
Pros: Phishing-proof (verifies server identity), works offline, no battery. Cons: Cost (per-key purchase), can be lost, requires USB/NFC port.
3. Passkeys
How it works: The successor to passwords. A cryptographic credential stored in your device’s secure enclave, synced across devices via your platform account (iCloud Keychain, Google Password Manager). Uses WebAuthn under the hood.
Examples: Apple Passkeys, Google Passkeys, Windows Passkeys.
Pros: No hardware to buy, synced across devices, phishing-resistant, user-friendly. Cons: Platform lock-in (Apple/Google/Microsoft), requires modern OS/browser.
4. Magic Links
How it works: User enters their email, receives a one-time link, clicks it to log in. The link expires after a short time (5-15 minutes).
Examples: Slack, Notion, many SaaS apps.
Pros: No password to remember, simple UX. Cons: Depends on email security, slow (wait for email), phishable (fake magic links).
5. Push Notifications
How it works: User initiates login, receives a push notification on their trusted device, approves with a tap.
Examples: Microsoft Authenticator, Duo Push.
Pros: Convenient, no codes to type. Cons: Vulnerable to MFA fatigue attacks (repeated push bombing), requires phone.
Comparison: authentication methods
| Method | Phishing-resistant | User experience | Cost | Recovery |
|---|---|---|---|---|
| Password + SMS 2FA | No | Poor | Low | Easy |
| Password + TOTP (Google Auth) | No | Medium | Low | Medium |
| Password + Push | No | Good | Low | Easy |
| FIDO2 Security Key | Yes | Good | Medium ($25-60/key) | Hard (backup key needed) |
| Passkey | Yes | Excellent | Free | Easy (synced) |
| Biometric + Passkey | Yes | Excellent | Free | Easy |
Why passwordless is more secure
1. Eliminates credential theft
No passwords = nothing to steal. Phishing pages can’t capture credentials that don’t exist.
2. Stops credential stuffing
Billions of leaked passwords circulate on the dark web. Passwordless makes them useless.
3. Prevents brute force
No password hash to crack. Cryptographic keys are computationally infeasible to brute-force.
4. Defeats MFA fatigue
FIDO2 keys and passkeys require explicit user action (touch/biometric) that can’t be automated or spammed.
5. Removes password reuse
The #1 cause of breaches — using the same password across services — is impossible without passwords.
Implementation roadmap
Phase 1: Assessment (Week 1-2)
- Inventory all applications and their authentication methods
- Identify which support FIDO2/WebAuthn/passkeys
- Map high-risk users (admins, privileged accounts)
- Choose identity provider (Entra ID, Okta, Google Workspace)
Phase 2: Pilot (Week 3-6)
- Enable passkeys/FIDO2 as optional MFA for IT team
- Distribute security keys to admins and executives
- Monitor adoption and collect feedback
- Document edge cases and fallback procedures
Phase 3: Rollout (Month 2-4)
- Expand to all employees in phases (department by department)
- Training sessions: “How to set up your passkey” (15 min)
- Enable passkeys on all compatible applications
- Set password as fallback (not primary)
Phase 4: Password elimination (Month 6+)
- Remove password option for critical systems (admin consoles, cloud portals)
- Enforce passwordless for VPN and remote access
- Monitor for password usage and nudge remaining users
- Keep password reset capability as emergency recovery
Enterprise considerations
Legacy applications
Not all applications support WebAuthn. For legacy apps:
- Use SSO (SAML/OIDC) to front passwordless identity
- Deploy a reverse proxy with authentication (e.g., Azure AD Application Proxy)
- Plan legacy app modernization on a separate timeline
Device management
Passkeys are device-bound or platform-bound. Ensure:
- MDM (Mobile Device Management) for corporate devices
- Clear policy for BYOD (Bring Your Own Device)
- Backup authentication methods for device loss scenarios
Compliance
Some regulations specify authentication requirements:
- PCI DSS 4.0: Supports passwordless, requires multi-factor
- NIST 800-63B: Recognizes FIDO2 as AAL3 (highest assurance level)
- NIS2/DORA: Require strong authentication — passwordless qualifies
The passkey ecosystem in 2026
The major platforms have aligned on passkeys as the password successor:
- Apple: Passkeys in iCloud Keychain, supported across iOS/macOS/Safari since 2022
- Google: Passkeys in Google Password Manager, Android and Chrome
- Microsoft: Windows Hello + passkeys in Entra ID, Edge browser
- 1Password, Dashlane, Bitwarden: Third-party passkey storage (cross-platform)
Cross-platform sync is the remaining challenge — a passkey created on iPhone doesn’t automatically work on a Windows PC. Third-party password managers are bridging this gap.
How nFlo can help
At nFlo, we help organizations transition to passwordless authentication:
- Identity security assessment — audit your current authentication landscape
- FIDO2/Passkey implementation — deploy across Entra ID, Okta, or Google Workspace
- Zero Trust architecture — passwordless as part of a broader Zero Trust strategy
- Security awareness training — help users adopt passwordless smoothly
Contact us to discuss your authentication modernization.
Related services and products
Frequently asked questions
Is passwordless authentication more secure than passwords?
Yes. Passwords are the #1 attack vector — 80% of breaches involve stolen or weak credentials (Verizon DBIR 2025). Passwordless eliminates phishing, credential stuffing, brute force, and password reuse attacks. FIDO2 keys are phishing-resistant by design — they cryptographically verify the server's identity before authenticating.
What is the difference between passkeys and FIDO2 keys?
FIDO2 keys are physical hardware tokens (like YubiKey) that store cryptographic credentials. Passkeys are the software equivalent — cryptographic credentials stored in your device's secure enclave (iPhone Face ID, Android fingerprint, Windows Hello). Both use the same WebAuthn protocol, but passkeys don't require a separate device.
How do I implement passwordless in my organization?
Start with a phased approach: (1) Enable passkeys/FIDO2 as an MFA option alongside passwords. (2) Migrate high-risk users first (admins, executives). (3) Gradually expand to all users. (4) Remove password as a fallback for critical systems. Key platforms: Microsoft Entra ID, Okta, Google Workspace all support passwordless natively.
What are the challenges of going passwordless?
Main challenges include: legacy application support (older apps may require passwords), user adoption (training needed), device dependency (lost phone = locked out without recovery), cost of hardware tokens for large organizations, and regulatory requirements that may mandate specific authentication factors.
