Passwordless authentication refers to methods that allow users to log into IT systems such as websites, databases, and applications without entering text-based passwords, credentials, or other “secrets.”
Instead of relying on passwords, users confirm their identity and gain access to systems in other ways. IT policies may be able to operate behind the scenes, for example, by using Single Sign On (SSO) to recognize a user and log them in automatically.
Alternatively, systems may use biometric evidence like fingerprints or facial recognition, possession-based factors like hardware tokens, or location-based factors like proximity badges, to confirm the user is who they claim to be before granting access.
At the moment, more focus is on the passwordless experience than passwordless implementation. With a passwordless experience, people authenticate to resources without seeing or having direct access to any shared secret.
Full passwordless implementation, in which the authentication system doesn’t maintain any shared secret at all, is much further off, especially for machine identities and service accounts.
Passwords have been an area of cybersecurity risk for a long time.
The rise of identity theft and data breaches can be commonly traced to weak or shared passwords. Even with good password hygiene, passwords can be stolen through phishing and brute force attacks.
The origins of passwordless authentication began in the 1980s with physical fobs holding one-time passcodes. This evolved into time-based and hash-based protocols in the 1990s before smart cards and early multi-factor authentication emerged.
Today, Google, Apple, Microsoft, and the media are driving the vision of passwordless authentication for consumer technology. Passwordless authentication in the workplace, though on a slower path than consumer tech, is also evolving.
Passwordless authentication can be achieved in different ways.
IT teams can choose suitable techniques based on convenience, security needs, and infrastructure compatibility.
While passwordless authentication has its benefits, it also poses challenges, such as:
When adopting passwordless systems, best practices include:
Specifically, organizations can:
By 2025, passwordless authentication revenue could hit $25 billion, expanding to over $50 billion by 2030 as adoption accelerates.
Ultimately, the question seems to be when, not if, passwordless authentication becomes the norm. With stronger cryptographic techniques, biometric adoption, and the maturation of security standards, it’s possible to imagine a future without fallible human-generated secrets.
More Resources:
Blogs
Unlocking the future: how passwords are evolving to keep you safe
Webinar
The Future of Passwords and the Passwordless Evolution
Original Research
Passwords and Passwordless Authentication Survey Report
Whitepapers
Beyond Password Managers
See why consumer-grade password managers aren’t sufficient to protect privileged accounts in the enterprise.
Multi-factor Authentication at Depth
Just because someone can present the right password doesn’t guarantee they are the user you think they are. Multi-factor authentication (MFA) mitigates risk throughout the chain of access control points.
Invisible Privileged Access Management
Reduce password fatigue and empower happy employees. With native integrations, Privileged Access Management sits behind the scenes and synchronizes all privileged identities, roles, permissions, and activities.