What is passwordless sign-in?
- Term
- Passwordless sign-in
- Meaning
- Passwordless sign-in proves who you are with a key on your device, not a password. Passkeys are the main example. Fill-in tools still use a password.
Passwordless sign-in is a way of proving who you are with a key kept on your device instead of a password.
What is passwordless sign-in?
The main example is the passkey, built on the FIDO standards. Your device holds a key and uses it to prove who you are, so you don’t type a password at all.
A different method can look similar. Some tools keep the app’s password and type it in for you. The fill-in features in identity providers such as Okta and Microsoft Entra ID work this way, and so do tools that enter a password without showing it. You don’t type anything there either, but the password still exists. That makes it a separate method.
How do passkeys work?
The FIDO Alliance, the industry group behind the FIDO standards, defines a passkey as “an authentication credential based on FIDO standards.” It can live on a phone, a computer or a security key (a small device you plug in or tap). Microsoft’s documentation explains the mechanism. The private key stays on your device, and the matching public key is stored with the site or app. Both are needed to sign in, and the pair is unique, so the passkey works only on the site or app it was created for.
You approve a sign-in the same way you unlock your device: with a fingerprint, your face or a PIN. A fake site that copies the real one has no key for you. Google’s help center calls passkeys an alternative to passwords that is more secure against phishing (fake sign-in pages that collect what you type).
Microsoft describes two kinds. A device-bound passkey never leaves the one device it was made on, as with a FIDO2 security key. A synced passkey is stored with a cloud passkey provider, such as Apple iCloud Keychain or Google Password Manager. Other devices signed in to the same provider can then use it.
How is it different from filling in a hidden password?
| Question | Passkey | Fill-in tool |
|---|---|---|
| Is there a password? | No. The device’s key proves who you are | Yes. The tool keeps it and doesn’t show it |
| What the app must support | Passkeys | Only a sign-in page |
| Phishing | Doesn’t work on a fake site | You can’t type what you don’t know, but it isn’t phishing-resistant as NIST defines it |
| Shared accounts | Belongs to the holder of the registered devices | One password can be filled in for several people |
With a fill-in tool, you don’t know the password, so you can’t type it into a fake page yourself. NIST SP 800-63B-4 sets a higher bar for “phishing resistance” in section 3.2.5. The sign-in method itself must keep secrets from reaching a fake site “without relying on the vigilance of the claimant.” That takes sign-in with a key pair, the way passkeys work. A fill-in tool still ends in an ordinary password check, so it doesn’t meet that bar. Check the tool’s documentation for whether it would ever fill your password into a look-alike page. How to get SSO-like sign-in for SaaS apps without SAML covers what Microsoft and Okta call their fill-in features and which apps they work with.
Which should you use?
If an app supports passkeys and each person has their own account, a passkey lets people sign in without a password that could leak. For apps without passkey support, and for accounts several people share, a password remains. How companies manage sign-ins to cloud apps lays out the methods for those.
Frequently asked questions
What is a passkey?
The FIDO Alliance defines it as a sign-in method based on FIDO standards, kept on a phone, computer or security key. You approve a sign-in the way you unlock the device, with a fingerprint, face or PIN.
Why are passkeys hard to phish?
Each key pair belongs to one site. Microsoft says a passkey works only on the website or app it was created for, so a fake site has no key to ask for.
Is a tool that fills in the password for you passwordless?
No. You don't type anything, but the app still keeps and checks a password, so a leaked password still works.
Can a shared account use a passkey?
A passkey sits on the device where it was made, or on devices synced through the same provider. NIST expects each user to keep their own sign-in device or app, so you'd have to decide whose devices hold it.
How Junify handles this
- Doing this by hand
- Single sign-on and multi-factor authentication don't reach apps that can't connect to your identity provider, or accounts that stay shared. Those are left to manual work, and you have to track for yourself which accounts the tools cover.
- With Junify
- Junify doesn't remove the password. It fills in a username and password an admin added, after the person confirms who they are on their own phone, so they never see it. That works for apps that don't support passkeys and for shared accounts. The password stays in place, but people use the account without knowing it.
Sources
- FIDO Alliance: Passkeys
- Microsoft Learn: Passkeys (FIDO2) authentication method in Microsoft Entra ID
- Google Account Help: Sign in with a passkey instead of a password
- Microsoft Learn: Add password-based single sign-on to an application - Microsoft Entra ID
- Okta Help Center: SWA app integrations
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025)
-
What's the difference between an audit log and audit evidence?
An audit log is what a system records. Audit evidence is a log you can rely on: tied to a person, protected from change, kept for a set period, and reviewed.
-
What a browser extension can and can't control in access management
An extension works inside the browser it's installed in, on the sites it's allowed to run on. Other apps, other browsers and other devices are out of its reach.
-
What work data stays on a personal computer, and how to keep it off
History, cookies, saved passwords, password manager copies and downloads. Pair company browser settings with logins that don't show people the password.