Quiz Entry - updated: 2026.10.22
What is passwordless authentication, and which methods are common?
Authentication that does without passwords entirely; common methods are biometrics, one-time passwords, magic links, hardware tokens and push notifications.
| Method | How it works | Example |
|---|---|---|
| Biometrics | A fingerprint or face scan, usually unlocking a key stored on the device | Face or fingerprint unlock with a passkey |
| One-time passwords (OTP) | A code that is valid once or for a short time, generated by an app or token | Google Authenticator |
| Magic links | A unique, single-use link sent by e-mail or SMS; clicking it logs you in | Slack's e-mailed sign-in link |
| Hardware tokens | A device that proves possession, often by signing a challenge | YubiKey, smartcards |
| Push notifications | The login triggers a prompt on a registered phone that the user approves | Authenticator app approval |
The motivation is to remove the reusable, phishable, forgettable secret that causes most account takeovers, and to spare users from managing dozens of passwords. The strongest modern form is passkeys (FIDO2/WebAuthn): the device holds a private key per website, unlocked by biometrics or a device PIN, and signs a challenge bound to the real website.
Go deeper:
Passwordless authentication (Wikipedia) — registration and login flow, benefits and drawbacks.- FIDO Alliance: Passkeys — how passkeys replace passwords with phishing-resistant key pairs.
passkeys.io demo — try a passkey sign-up and login in the browser.