Passwordless authentication
Passwordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications. Requirements v3.3 updated the definition to include FIDO2, which is regarded as MFA. It appears as option D at A4.3 and A5.5, which needs a notes description.
- Term
- Passwordless authentication
- Also known as
- Passwordless
- Category
- Accounts and access
- Requirement area
- B. Definitions; 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term passwordless authentication mean in Cyber Essentials?
Passwordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications.
Passwordless authentication is a method to establish a user's identity that uses a factor other than knowledge. Examples include but are not limited to: FIDO2 authenticators, biometric data, security keys or tokens, one-time codes, QR codes, and push notifications.
How does passwordless authentication apply to Cyber Essentials?
In plain terms
Passwordless sign-in replaces "something you know" with something you have or something you are. You unlock with your face or fingerprint, tap a security key, or approve a prompt on your phone, and no password is typed. With nothing to type, there is nothing to reuse or hand to a fake login page.
What does Cyber Essentials say?
Section B of v3.3 defines the term as quoted above. The update to include FIDO2 is one of the six changes listed in v3.3. The user access control section gives common examples:
| Method in the requirements | What it is |
|---|---|
| Passkeys | "Passwordless login technology based on public-key cryptography". FIDO2 authenticators count as passkeys. |
| Biometric authentication | Fingerprints or facial features |
| Security keys or tokens | "Physical hardware devices such as USB security keys or smart cards" |
| Push notifications | "A prompt on a smartphone to approve or deny a login attempt" |
| One-time codes | "Temporary codes are sent via email, SMS, or a mobile app" |
The key sentence for answering questions is: "FIDO2 authenticators are regarded as MFA because user authentication is performed."
Which questions apply?
- Option D in A4.3 (firewall password) and A5.5 (external service authentication) is "passwordless" and needs a notes description of the method.
- A7.10 asks how passwords are protected from brute force "where passwords are a backup for a passwordless system", so any password fallback must still meet the throttling or lockout rules.
- A7.11 still applies to any password that remains in use.
Common mistakes
- Turning on passkeys but leaving an unprotected password login available as a fallback.
- Describing the whole organisation as passwordless when only some accounts are enrolled. Answer for the accounts as they are.
See the user access control requirements, what changed in 2026 and passkeys, FIDO2 and Cyber Essentials. Related: passkey, FIDO2, biometrics.
Related terms
- PasskeyA passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN.
- FIDO2FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password.
- BiometricsBiometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password.
- Privileged accessPrivileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
- Service accountA service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files.
- Shared accountA shared account is a single login that more than one person uses, such as one office email login whose password the whole team knows.
Frequently asked questions
Passwordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, passwordless authentication comes up at A4.3, A5.5, A7.10, A7.11. Read those questions against the definition above so your answers use the term the way the assessor will.
Passwordless authentication relates to B. Definitions; 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.