Passwordless authentication
Any sign-in that skips the password: emailed links, one-time codes, or passkeys carry the proof instead.
See it
What it is
Passwordless authentication is the umbrella term for any sign-in where the user never sets or types an account password. The proof comes from something else: a magic link or code sent to an email address, an SMS or authenticator OTP, a passkey unlocked by biometrics, or a social login handled by another provider. What you delete is the password database, the reset flow, and the credential-stuffing risk that comes with reused passwords.
Choose by how often people log in and how much the account is worth. Passkeys are the strongest option and the one to default to in 2026. Email links suit tools people open weekly. OTP codes travel better on mobile and in bad-email environments. SMS is the weakest link in the family thanks to SIM swapping, so treat it as a fallback rather than the plan.
The misconception worth killing: passwordless is not automatically stronger. Email-only login just moves the entire security boundary into the user's inbox, and it fails badly when mail is delayed or filtered. Real deployments run two methods plus a recovery path, because a single factor with no backup turns every lost phone into a support ticket. Expect a transition period where passwords still exist for older accounts, and design the upgrade prompt rather than a forced cutover.
Ask AI for it
Move this app to passwordless authentication in stages, without stranding anyone. Add passkeys (WebAuthn) as the primary method with conditional UI on the email field, plus a 6-digit emailed one-time code as fallback, expiring in 10 minutes with a maximum of 5 attempts. Keep password login and password reset working for legacy accounts throughout the migration. After a successful password login, offer passkey enrollment rather than forcing it. Delete a given user's password credential only once they have enrolled and verified an alternative method, and retire the global password and reset flows only after the migration is finished and measured. Provide downloadable recovery codes, let users register more than one passkey, rate limit code requests per email and IP, and show identical responses whether or not an account exists.