Which passkey is right for you?

Passwordless logins explained

Posted on 29 June 2026 by Beaming Support

Passwords are no longer enough on their own to protect business systems and data. They can be guessed, stolen, reused or exposed in data breaches, which is why many organisations already use multi-factor authentication to add an extra layer of protection.

Passwordless login takes this a step further. Instead of relying on a password, it uses modern authentication methods such as passkeys, biometrics, device PINs or hardware security keys to confirm that the right person is accessing the right system.

This article explains how passwordless login works, the benefits and drawbacks, and how to choose the right approach for your organisation.

Why go passwordless?

Passwordless authentication reduces reliance on passwords, which can be guessed, reused, stolen or exposed in data breaches. Instead of asking users to type a password, it uses methods such as passkeys, biometrics, device PINs or hardware security keys to confirm access.

Passkeys use public-key cryptography. A private key stays on the user’s device or security key, while the service stores a matching public key. This makes passkeys highly resistant to phishing because they are linked to the genuine website or application.

Benefits

  • Stronger protection against phishing: Passkeys are tied to a specific website or app, so they are much harder to use on a fake login page.
  • Fewer password risks: There is no reusable password for an attacker to steal, guess or reuse.
  • Easier sign-in: Users can sign in with Face ID, Touch ID, Windows Hello, a device PIN or a hardware security key.
  • Targeted deployment: You do not have to introduce hardware security keys for everyone at once. A practical starting point is to review who has access to privileged systems or sensitive data, then apply stronger authentication controls to those users first.

Considerations

  • Account recovery needs planning: If a user loses their primary device and has no backup or recovery method, regaining access can be more difficult.
  • Hardware keys must be managed carefully: If a security key is lost or damaged, the user may be locked out unless a spare key or recovery process is in place.
  • Device suitability matters: Software passkeys and app-based authentication often rely on a user having access to a suitable phone, laptop or tablet.
  • Compatibility should be checked: Hardware keys need to work with the devices users rely on, including USB-C, USB-A, NFC or Bluetooth support.
Asset 30

Is your business fighting 2000 cyber threats a day?

Beaming has analysed cyber attacks in real-time targeting thousands of UK-based businesses since the beginning of 2016.

From this, we can calculate the average number of attacks businesses receive, where threats originate and what applications are most targeted. We use the results of the analysis to help organisations improve their cyber security.
Read the latest cyber report

Comparing passwordless solutions:

  Hardware security keys

e.g. Yubico Security Key Series

 Software passkeys / app-based authentication

e.g. Microsoft Authenticator
Form You require a separate USB, NFC or Bluetooth security key that is assigned to an individual user and cannot be shared. The passkey is stored securely on a trusted device, such as a smartphone, tablet or computer.
How it works The security key is connected to the device using USB, NFC or Bluetooth. The user then verifies their identity with a PIN, fingerprint or other biometric method to complete authentication.. The passkey is stored securely on your device. When you sign in, you confirm your identity using a biometric check (such as Face ID or a fingerprint) or a device PIN. The passkey then authenticates you without requiring a password.
Convenience You must physically have the separate key with you to log in. You are likely to have your phone with you already, so there is little change to your normal routine.
Recovery A spare key or backup authentication method should be registered to avoid lockout if the main key is lost or damaged. Passkeys may be recoverable if they are synced through the user’s Microsoft, Apple or Google account, depending on how they are configured.
Cost Initial purchase cost varies by model. We typically recommend keys costing around £60 each. There are no ongoing licence fees. Microsoft Authenticator is available within your Microsoft 365 Account, with no additional licence required.
Pros ·         Offers a high level of protection against phishing because the physical key cannot be stolen remotely.

·         Does not rely on a specific platform provider, allowing credentials to be used across compatible devices and services.

·         Provides strong security for privileged accounts and users with access to sensitive systems.

 

 ·      Easy to adopt because users can authenticate using devices they already own and use every day.

·      Passkeys can be synchronised across devices, making it straightforward to set up a new phone, tablet or computer and continue accessing accounts.

·      No additional hardware is required, reducing costs and simplifying setup.

 
Cons ·         Loss or theft of the key can result in account lockout if no backup authentication method is available.

·         If you use multiple devices throughout the day or move between work locations, you have to remember to bring the key with you.

·         You have to ensure the key is compatible with all devices – e.g USB-C ports might not be available on older laptops.

 ·         Requires users to have a suitable device, which is often a personal device.

·         If you forget your phone or it is out of battery you will impact productivity.
Best for High-security environments, privileged accounts, administrators and organisations seeking the strongest protection against phishing. Everyday business use where organisations want a balance of security, convenience and ease of deployment.

Passwordless login can help businesses reduce their reliance on passwords, improve protection against phishing and make sign-in simpler for users.

For everyday access, software-based passkeys can offer a good balance of security and convenience, especially where users already rely on trusted devices. For administrators, senior staff and users with access to sensitive data, hardware security keys can provide a stronger level of protection.

The right approach depends on your users, devices, systems and risk profile. A good starting point is to review who has access to business-critical systems, then introduce passwordless authentication where it will have the greatest security benefit with the least disruption.

FAQs

Passwordless questions answered