What is Secretless (Passwordless) Authentication?

Any method of verifying identity that does not depend on a shared secret like a password, PIN, or passphrase counts as passwordless. Instead of matching a string the user knows against a string the server stores, passwordless methods verify a possession factor (a device, a phone, a hardware token) and often an inherence factor (a biometric like a fingerprint or face scan). The distinction matters because a password is a shared secret. The user knows it, the server stores a representation of it, and anything in between, from a phishing page to a compromised database, can capture it. Passwordless authentication removes that shared secret entirely. 

Benefits of Passwordless Authentication

Passwordless authentication methods eliminate the need for users to remember and enter passwords, which removes the single most attacked credential in security and the risks that come with it: credential theft, phishing, credential stuffing, and brute-force attacks. There is no password to reuse across sites, no password to write down, and no central store of secrets to breach.

As a result, passwordless authentication creates several benefits:

• Immunity to phishing: A cryptographic signature is bound to the legitimate domain, so a fake login page cannot produce a valid one, and there is no password for the user to hand over.
• Credential stuffing has nothing to replay: Attackers cannot reuse passwords stolen from one service against another, because there are no passwords.
• Breaches expose nothing useful: A breached server holds only public keys, which are worthless to an attacker on their own.
• Brute force and password spraying have nothing to guess: There is no secret to attack.
• Improved user experience and lower help-desk load: Removing passwords also removes password resets, rotations, and a large share of account-recovery tickets.

It helps to separate passwordless from its close relatives. Multi-factor authentication (MFA) adds a second check on top of a password, while passwordless replaces the password outright. A passkey is a specific, standards-based form of passwordless login built on public key cryptography. The next sections cover each.

Elements of Passwordless Authentication

Passwordless is a category rather than a single technique, and the methods differ sharply in how phishing-resistant they are. Most modern passwordless authentication runs on public key cryptography, the same math that secures HTTPS. When you register a device, it generates a key pair: a private key that never leaves the device and a public key that the service stores. There is no shared secret, so there is nothing to phish. The standards that make this work are FIDO2 (Fast Identity Online 2) and WebAuthn (the Web Authentication API), developed by the FIDO Alliance and the W3C. Here is the flow in practice:

1. Registration. Your device (a laptop, phone, or hardware security key) creates a unique public/private key pair for the service. The private key is stored in secure hardware, often protected by a biometric or PIN. Only the public key is sent to the server.
2. Authentication challenge. When you sign in, the server sends a random challenge to your device.
3. Signing. Your device unlocks the private key (you confirm with a fingerprint, face, or PIN) and signs the challenge. The signed response goes back to the server.
4. Verification. The server verifies the signature against the public key it stored at registration. A valid signature proves you control the private key, without that key ever crossing the network.

Because the private key never leaves the device and the server only ever holds a public key, there is no secret in transit and no secret at rest that an attacker can steal.

The category includes several technologies, which differ in assurance:

• Biometric authentication. A fingerprint, face, or (less commonly) voice or iris verifies an inherence factor. In practice the biometric rarely authenticates you to a remote server directly. It unlocks a private key held in secure hardware on your device, such as a phone's secure enclave or a laptop's trusted platform module (TPM). The biometric data itself stays on the device. That is what makes device biometrics both convenient and strong: an attacker would need your physical device and your fingerprint or face. The caveat is that biometrics are only as trustworthy as the device protecting them, which is why device trust matters.
• Security keys and hardware tokens. A FIDO2 security key such as a YubiKey is dedicated hardware that stores private keys and performs the signing operation, and signing in requires physically tapping or inserting it. This is the highest-assurance form of passwordless authentication available today, because the private key is bound to tamper-resistant hardware and the protocol cryptographically ties each login to the legitimate site's domain. That domain binding is what makes hardware keys phishing-resistant by design. Even on a fake login page, the key will not produce a valid signature for the wrong domain. This trade-off is logistical: keys cost money, can be lost, and require a clear recovery and backup process.
• Multi-factor authentication (MFA), and how it differs. It is easy to conflate MFA with passwordless, but they are not the same. MFA traditionally combines something you know (a password) with something you have (a one-time password, or OTP) or something you are (a biometric), so the password is still there, and so is its attack surface. Passwordless removes the knowledge factor entirely. A well-designed passwordless login can still be multi-factor, for example a hardware key (possession) unlocked by a fingerprint (inherence), but it never relies on a shared secret. The goal is not to stack more checks on top of a password, but to retire the password completely.
• Magic links, SMS, and push notifications. Some methods marketed as passwordless are weaker than the key-based approaches above, and honesty here matters. Magic links email a one-time sign-in link but shift trust to the email account, which is itself often protected by a password. SMS one-time passwords are convenient and better than a static password alone, but SMS is vulnerable to SIM-swapping and real-time interception. Push notifications are better than SMS but susceptible to "MFA fatigue" attacks where an attacker spams approval prompts until a tired user taps yes. These methods are passwordless in the narrow sense, but none are phishing-resistant the way FIDO2 keys and platform passkeys are.
   

The Role of Passwordless in Modern Security

Passwordless authentication is more secure than passwords plus MFA when it is built on public key cryptography rather than codes sent over email or text. It counters modern threats such as credential stuffing, account takeover, and breaches that start with a weak or reused password by removing the credential behind most of them. As a growing public key infrastructure (PKI) use case, passwordless authentication proves identity without ever exposing the private key, and it aligns directly with the principles of zero trust by verifying every access request on true, cryptographically proven identity rather than a shared secret.

What passwordless does not solve on its own is just as important to state plainly. The security shifts to the device that holds the private key, so device trust matters, because a compromised endpoint can put the key at risk. Account recovery also needs careful design, because the "forgot my password" flow is often the weakest link, and a poorly built recovery path can reintroduce exactly the phishable shortcut you removed. Passwordless is a major upgrade, but it is part of a layered posture rather than a single switch.

[Callout box: What passwordless solves, and what it does not. It eliminates the phishable, reusable, breach-exposed password. It does not eliminate the need for device trust, strong endpoint hygiene, and a recovery flow as phishing-resistant as the primary login.]

For a deeper walkthrough of the mechanics, see how passwordless authentication works and our explainer on FIDO2 and WebAuthn.

Passwordless vs Secretless Authentication

Everything above applies to human logins for apps and websites. But the same logic of getting rid of the shared secret has a much larger payoff in infrastructure access, and this is where Teleport extends passwordless into what we call secretless. Secretless authentication is a core element of Teleport's unified identity platform, alongside cryptographic identity, zero trust, ephemeral privileges, and identity and policy governance.

When an engineer connects to a server, database, Kubernetes cluster, or cloud console, the credential in play is rarely just a password. It is an SSH key, an API token, a kubeconfig, a database password, or a long-lived cloud secret. These static credentials sit on laptops, in CI/CD pipelines, AI agents, and in config files. They are the infrastructure equivalent of a password that never expires, and they are the standing target attackers go after. Going passwordless at the login screen while these credentials persist behind it solves only half the problem.

Secretless authentication closes the rest of the gap. Instead of issuing standing keys and secrets, Teleport issues short-lived cryptographic certificates scoped to a specific identity, with zero standing privileges. The certificate is minted just in time, expires in minutes or hours, and leaves nothing durable for an attacker to steal. This is passwordless applied to every door in your infrastructure, not only the front one. For the conceptual foundation, see what cryptographic identity means and why static credentials are the weak point.

Teleport extends a single, cryptographically secured identity layer across the four kinds of identity in modern infrastructure: humans, machines, workloads, and AI agents. For human engineers, Teleport Zero Trust Access delivers passwordless, least-privileged access using device biometrics and FIDO2, including passwordless desktop access to Windows and Linux machines without a shared local password. The same model extends to SSH; see our comparison of passwordless SSH authentication methods and our take on the end of passwords in infrastructure. Teleport supports FIDO and WebAuthn so users authenticate without passwords, which also reduces the help-desk burden of password resets and account recovery. It extends beyond human access too, securing machine-to-machine communications so every entity in the infrastructure authenticates on inherent or possession factors rather than stealable credentials. Teleport Identity Security then gives security teams the immutable audit log and session recording they need to prove who accessed what, which is how passwordless stays compliant as it scales.

Passwordless removes the secret a human types. Secretless removes every standing secret behind it, including the ones machines and AI agents use to authenticate to each other. Both rest on the same idea: that identity, proven cryptographically, should be the basis of trust, not a string that can be copied.

Conclusion

Passwordless authentication is one of the clearest security upgrades available. By removing the shared secret, it eliminates the credential behind most breaches. The strongest forms, built on FIDO2, WebAuthn, and device biometrics, are phishing-resistant by design, while weaker methods like SMS codes only partly close the gap. The principle is to retire the password, not stack more checks on top of it.

For infrastructure, the same idea goes further. Standing keys, tokens, and secrets are passwords by another name, and they are what attackers reach for. An identity-first approach replaces them with short-lived cryptographic identity, so access is passwordless at the login and secretless everywhere behind it. That is how Teleport Zero Trust Access and Teleport Identity Security deliver passwordless access in practice, across humans, machines, workloads, and AI agents.