Passwordless authentication removes the reliance on traditional passwords and instead relies on strong, cryptographic-based login mechanisms. The primary technology behind passwordless authentication is the use of local tokens or certificates, particularly implemented through protocols like FIDO2 and WebAuthn.

These mechanisms work by storing a private key on the user’s device (like a hardware security module or TPM), while the public key is stored with the cloud service. When a login attempt is made, the system uses asymmetric cryptography to verify the user—without ever transmitting a secret like a password.

“Passwordless authentication is enabled by mechanisms such as biometric verification and secure local credentials like hardware-bound certificates or tokens. The use of cryptographic authenticators (such as FIDO2) is becoming the cornerstone of secure, phishing-resistant authentication.”

— Security Guidance for Critical Areas of Focus in Cloud Computing v4.0, Domain 12: Identity, Entitlement, and Access Management

Also supported by the Cloud Controls Matrix (CCM) under IAM-12:

“Utilize multifactor authentication or strong authentication mechanisms such as cryptographic tokens or certificates for user access to cloud services.”

— Cloud Controls Matrix v3.0.1 (IAM-12)