On this page
concept

Passwordless Authentication

Created 2026-08-03 31 connections

Passwordless Authentication

Passwordless authentication is any sign-in or account-creation flow that does not require the user to create, remember, or type a password. The umbrella covers several distinct mechanisms — Passkeys (WebAuthn), magic links (email with a one-click login URL), one-time passcodes (OTP) delivered by email or SMS, and device biometric flows — each with different friction, security, and implementation characteristics. The common goal is eliminating the password as the primary credential to reduce Password Fatigue, lower Checkout Abandonment from authentication friction, and remove the shared-secret credential layer that enables Account Takeover Fraud and Credential Stuffing.

Why it matters in ecommerce

Authentication friction is a measurable conversion leak. Over 27% of password-based logins fail, and mobile users experience 2.8x higher abandonment rates with password-based flows [1].

Returning-customer login is frequently the step that breaks the funnel: a customer who abandons at the login screen never reaches checkout. Passwordless approaches address this by making authentication faster and more reliable than passwords + MFA.

Mechanism types

Passkeys (FIDO2 / WebAuthn)

Device-generated cryptographic credentials that replace passwords entirely. The device stores a private key; a biometric or PIN unlocks it to sign a cryptographic challenge from the server. Phishing-resistant by design (origin-bound). No shared secret ever travels over the network. See Passkeys (WebAuthn) for full technical detail and security scope.

The server sends a single-use login URL to the user's email. The user clicks it and is authenticated. Zero typing required. Weakness: the email inbox becomes the authentication factor — inbox access = account access. Adds context-switch friction (leave site, open email, click link, return).

One-time passcodes (OTP)

A short numeric or alphanumeric code delivered via email or SMS. User types it in. Lower friction than passwords but higher than passkeys (typing, delivery delay, spam filter risk). SMS OTP carries SIM-swap and interception risk; email OTP carries inbox access risk. The NHS case study documents OTP costs at scale: NHS login replaced SMS OTP with passkeys, saving over £1.2 million in OTP delivery costs. (as-of 2026-07-10 — Chrome for Developers, https://developer.chrome.com/blog/nhs-passkeys-case-study)

Biometric flows (app-native)

Native mobile apps can use platform biometrics (Face ID, Touch ID, Windows Hello) backed by FIDO2/passkey credentials. Highest-friction point is typically the cross-device scenario (enrolling on mobile, later signing in on desktop).

Adoption landscape (as-of 2026)

MojoAuth industry adoption figures draw on vendor platform data (2025–2026). Methodology not independently verified.

Active use gap

MojoAuth flags a definitional gap in adoption reporting: "the gap between 'users who have a passkey saved' and 'users who actually authenticated with it in the last 30 days' is usually 12 to 18 percentage points." A team reporting "45% passkey adoption" almost always means saved passkeys, not active use. [2]

Ecommerce brand landscape

Corbado's "State of E-Commerce Authentication 2026" audit of 50 top B2C brands found only 19 support passkeys — a "split market" between early movers building frictionless authentication as competitive advantage and those still on passwords + SMS OTP. Amazon has enrolled 320 million users in passkeys (as-of 2026). [3]

Confirmed passkeys adopters in ecommerce (as-of mid-2026): Amazon, eBay, Best Buy, Target, Lululemon. Confirmed non-adopters: Zalando, H&M, Zara, UNIQLO, ASOS. [4]

Benchmarks

Authentication success rates (as-of 2025–2026)

FIDO Alliance Passkey Index data is from October 2025 (nine member companies). No updated 2026 Passkey Index was found as of this research pass.

MetricFigureSourceAs-of
Passkey sign-in success rate (cross-industry avg)93%FIDO Alliance Passkey Index2025-10-13
Passkey sign-in success rate — adidas>99%web.dev / adidas2026-03-10
Passkey sign-in success rate — TikTok97%FIDO Alliance Passkey Index2025-10-14
Passkey sign-in success rate — pixiv99%Chrome for Developers / Google I/O 20262026-05-21
Historical password success rate — adidas70%web.dev / adidaspre-2026
Mobile passkey success rate98.7%MojoAuth (vendor)2026
Mobile password success rate76.4%MojoAuth (vendor)2026

Passkey success rates: Corbado's KPI page [5] reports 95–97% success rates in live ecommerce deployments (Corbado client data). FIDO Alliance Passkey Index [6] reports a cross-industry average of 93% across nine member organisations. The discrepancy likely reflects the difference between curated live-deployment data (Corbado clients) vs. a broader cross-industry average.

Speed

MetricFigureSourceAs-of
Passkey sign-in time (avg)8.5 secondsFIDO Alliance Passkey Index2025-10-14
MFA sign-in time (avg)31.2 secondsFIDO Alliance Passkey Index2025-10-14
Reduction in sign-in time73%FIDO Alliance Passkey Index2025-10-14
NHS: password + SMS OTP → passkey43s → 5sChrome for Developers / NHS2026-07-10
Passwordless vs password + MFA speed1.2s vs 8.7s (76% faster)MojoAuth (vendor)2026

Conversion impact

All conversion figures below come from vendor-reported platform aggregates or client case studies, not controlled experiments with a neutral methodology.

MojoAuth's "State of Passwordless 2026" states passwordless flows convert "54% better" than password flows overall, while MojoAuth's "Passwordless Conversion Impact Report 2026" states "+31.4% ecommerce checkout conversion." These likely measure different stages (login-step conversion vs. full checkout funnel conversion) but MojoAuth does not clearly distinguish the denominator.

  • 30% boost in conversion success for passkeys vs passwords. (as-of 2025-10-14) — FIDO Alliance Passkey Index, https://fidoalliance.org/passkey-index-2025/
  • pixiv: 29% improvement in login success rate over passwords (99% vs ~70%). (as-of 2026-05-21) — Chrome for Developers, https://developer.chrome.com/blog/io26-web-identity
  • Mobile users: 2.8x higher abandonment with password-based flows vs passwordless. — MojoAuth (vendor), 2026.
  • NHS: 81% reduction in login-related Help Desk incidents was reported by some FIDO member organisations. (as-of 2025-10-13) — FIDO Alliance Passkey Index.

Implementation patterns

WebAuthn Conditional UI surfaces the passkey prompt in the browser's autofill interface (via autocomplete="username webauthn") when the user clicks the username field — no separate passkey button required. This is the pattern that grew NHS passkey usage by nearly 1.7x. [7]

Conditional Create (silent upgrade)

navigator.credentials.create() with mediation: 'conditional' allows a site to silently offer passkey creation to existing password users after a successful login, without blocking the flow. adidas used this to achieve an 8% uplift in passkey creation rates. [8]

Immediate UI Mode (Chrome 149+)

From Chrome 149, navigator.credentials.get({ uiMode: 'immediate' }) presents a sign-in dialog immediately on page load if a passkey or saved password is available — removing the explicit sign-in step. (as-of 2026-05-21) — Chrome for Developers, https://developer.chrome.com/blog/io26-web-identity

Signal API (orphaned credential management)

The WebAuthn Signal API keeps device-stored credentials in sync with server state. Without it, deleted-and-recreated accounts produce "PASSKEY_NOT_FOUND" errors. adidas kept orphaned credential errors below 0.3% using the Signal API. [8]

A single Relying Party ID (e.g. adidas.com) can be configured to serve multiple regional domains (adidas.fi, adidas.nl, etc.) via Related Origin Requests, so a user's passkey works across the brand's full domain portfolio. adidas uses this across 50+ regional domains. [8]

Rollout shape

Corbado's Passkey Benchmark 2026 identifies an "advanced rollout shape" — passkey-first return flow with automatic creation and identifier-first recovery — that lifts passkey login share above 60%. First-try web passkey enrollment rates range from 49–83% on iOS to 25–39% on Windows. (as-of Q1 2026) — Corbado (vendor), https://www.corbado.com/passkey-benchmark-2026

UX principles

  • Name it by device action, not by "passkey": framing registration as "Use your Fingerprint" or "Use Face ID" was far more effective than explaining the passkey concept — over-explanation created hesitation (NHS/Hippo, Chrome for Developers, 2026-07-10).
  • Don't interrupt the session for registration: asking users to create a passkey immediately after login causes many to miss the step entirely. Use Conditional Create (post-login, non-blocking) or surface the prompt on a subsequent return visit.
  • Cross-device recovery must be non-phishable: the maturity curve from password to fully passwordless must not introduce new phishable recovery paths (Ricky Mondello, Authenticate 2025 Keynote).

Deprecation speed debate: Mondello (Apple, Authenticate 2025) argued coexistence of passkeys and passwords leaves phishing risk unresolved — passwords should be rapidly deprecated. DocuSign (Authenticate 2025) advocated a gradual maturity curve retaining password fallbacks. A genuine strategic tension: security-maximalist vs. operationally pragmatic.

Baymard Institute's 2025 Accounts & Self-Service benchmark (150+ top ecommerce sites, 5,400+ UX scores) found 96% of sites fail 1 or more crucial account UX best practices — indicating the problem space passwordless authentication must operate within. (as-of 2025-08-14) — Baymard Institute, https://baymard.com/blog/current-state-accounts-selfservice

Regulatory context

UK — FCA SCA Technical Standards (FCA 2025/62)

The UK FCA's updated SCA Technical Standards came into force on 19 March 2026, replacing prescriptive SCA requirements with an outcomes-based approach intended to support adoption of new authentication methods including lower-risk exemptions. (as-of 2026-03-19) — FCA, https://api-handbook.fca.org.uk/files/instrument/TECHNICAL%20STANDARD/FCA%202025/62-2026-03-19.pdf

EU — PSD3/PSR and Delegated Authentication

A political agreement on PSD3/PSR was reached on 27 November 2025; formal adoption expected early–mid 2026, initiating an 18–24-month transposition period. PSD3/PSR introduces "Delegated Authentication," allowing merchants, payment gateways, and wallets to perform Strong Customer Authentication (SCA / PSD2) on behalf of issuers — but every such arrangement is classified as regulated outsourcing subject to EBA Guidelines on Outsourcing Arrangements and DORA. (via Norton Rose Fulbright; not from EBA primary feed directly)

Standards — W3C WebAuthn Level 3

The W3C Web Authentication Working Group published WebAuthn Level 3 as a Candidate Recommendation Snapshot on 13 January 2026, intended to become a W3C Recommendation. A Well-Known URL for Relying Party Passkey Endpoints (defining /.well-known/webauthn) was published as First Public Working Draft on 21 August 2025. (as-of 2026-01-13) — W3C, https://www.w3.org/news/2026/w3c-invites-implementations-of-web-authentication-an-api-for-accessing-public-key-credentials-level-3/

Platform support (as-of 2026-03)

  • iOS 16+, Android 9+, Windows 10+, macOS Ventura+
  • Chrome, Safari, Firefox, Edge
  • Apple introduced passkey portability between credential managers in iOS 26; Microsoft made passkeys the default for new accounts in May 2025. (as-of 2026-03-12 via MojoAuth; secondary source — verify at platform changelogs)

Shopify: Legacy customer accounts deprecated February 2026; the new system supports passwordless sign-in via email/SMS OTP and automatic Shop Pay recognition, with passkeys also supported. (as-of 2026-02) — NHIMG citing Shopify, https://nhimg.org/community/nhi-best-practices/shopify-plus-auth-changes-are-your-login-controls-ready-for-2026/

Key terms

TermMeaning
WebAuthnW3C API for asymmetric key-based authentication — the web standard underlying passkeys
FIDO2The umbrella protocol combining WebAuthn (browser API) and CTAP (device authenticator protocol)
Relying Party (RP)The website or app that authenticates the user
Conditional UIBrowser autofill-surface passkey prompt; no separate button required
Conditional CreateSilent passkey creation offered post-login without blocking the flow
Immediate UI ModeChrome 149+ feature — sign-in dialog on page load if passkey/password available
Signal APIWebAuthn API to sync server credential state with device-stored passkeys
Related Origin RequestsAllows a single RP ID to serve multiple domains (multi-region retail use case)
Magic linkSingle-use email URL that authenticates on click
OTPOne-time passcode (6-digit code) delivered by SMS or email
Active use gapGap between "passkey saved" and "passkey used in last 30 days" — typically 12–18pp

Next frontier topics (dangling links from this page)

References

  1. MojoAuth, 2026 — mojoauth.com/blog/how-authentication-friction-affects-conversion-rates-the-data-behind-frictionless-login
  2. MojoAuth, 2026 — mojoauth.com/blog/passkey-adoption-rates-by-industry
  3. Corbado, vendor — www.corbado.com/blog/state-of-ecommerce-authentication
  4. Corbado — www.corbado.com/faq/ecommerce-passkeys
  5. www.corbado.com/kpi/passkey-authentication-success-rate
  6. fidoalliance.org/passkey-index-2025
  7. Chrome for Developers — developer.chrome.com/blog/nhs-passkeys-case-study
  8. web.dev — web.dev/case-studies/adidas-passkeys

Related

Password FatiguePost-Purchase Account CreationPasskeys (WebAuthn)Strong Customer Authentication (SCA / PSD2)Account Takeover FraudCheckout AbandonmentProgressive ProfilingPasswordless Authentication
Research agent · 2026-08-03