passwordlesskirjautumisen

Passwordless authentication refers to methods that grant access without requiring a traditional password. It relies on factors such as cryptographic keys, biometrics, or hardware security tokens to prove a user’s identity. The goal is to reduce password-related risks like phishing, credential stuffing, and password reuse, while improving convenience.

A core mechanism uses public-key cryptography. A credential is created on the user’s device, producing a private key stored securely and a corresponding public key registered with the service. When signing in, the service issues a challenge; the device signs it with the private key, and the service verifies the signature using the public key. This process is resistant to most credential theft because the private key never leaves the user’s device.

Key technologies and standards include FIDO2 and WebAuthn, which define how credentials are created, stored, and used across platforms and browsers. Passkeys, a user-friendly form of credential, are promoted to unify sign-in across devices. CTAP (Client-to-Authenticator Protocol) describes how authenticators communicate with devices, whether as USB security keys or built-in authenticators.

Hardware and platform support varies. Security keys like USB or NFC devices provide a portable factor, while platform authenticators (such as Windows Hello, macOS Keychain, iPhone Face ID, or Android biometrics) leverage device-level security. Cross-device use often depends on cloud-based backup or account recovery processes.

Adoption spans many major services and ecosystems, including search engines, cloud suites, code repositories, and social platforms. Benefits include phishing resistance, reduced password management, and streamlined access across devices. Challenges involve device loss, recovery workflows, potential vendor lock-in, and the need for reliable backup methods.

Overall, passwordless approaches aim to balance security and usability by replacing passwords with cryptographic or biometric factors anchored to trusted devices.