Passwordless authentication is any method of verifying a user’s identity without a shared secret password, relying instead on possession and biometric factors such as a hardware security key, a device-bound passkey, or a fingerprint. The aim is to remove the password entirely rather than strengthen it.
Most modern implementations use public key cryptography. During registration the device generates a key pair, keeps the private key locked in secure hardware, and registers the public key with the service. At sign-in the service sends a challenge, the device signs it, and the service verifies the signature. FIDO2 and WebAuthn are the standards behind passkeys that work this way. Because no reusable secret travels to a server or sits in a database, phishing and credential-stuffing attacks lose most of their power; an attacker cannot phish a private key that never leaves the device. The realistic watch-out is account recovery. If a user loses their only registered device, a weak recovery process can quietly reintroduce the risk passwordless was meant to eliminate.
How is passwordless authentication tested on the CISSP?
Passwordless authentication belongs to Domain 5 (Identity and Access Management), which is 13% of the exam. Know the authentication factors, the role of public key cryptography, and phishing resistance. See Domain 5 Identity and Access Management for context.