A passwordless auth playbook
Best practices for secure, phone-first authentication and onboarding flows.
Why go passwordless?
Passwords are the leading cause of account breaches. Phishing, credential stuffing, and reuse attacks all depend on static secrets. Removing passwords from your authentication flow eliminates the entire class of attacks at once.
OTP vs magic link vs passkey
SMS OTPs are familiar but susceptible to SIM-swap attacks. Magic links sent to email are phishing-resistant but depend on email security. Passkeys — based on the WebAuthn standard — are the gold standard: device-bound, phishing-proof, and increasingly supported across iOS, Android, and desktop browsers.
Onboarding flow design
A passwordless onboarding should ask for the minimum required upfront. Collect an email or phone, send a one-time verification, and let users set up a passkey on first login. Progressive profiling — asking for more detail over time — keeps drop-off rates low.
Fallback strategy
Always provide a secure fallback for users who lose device access. A verified email recovery flow with rate-limited OTPs is sufficient. Avoid security questions — they are effectively public information for most users.