Table of Contents

What Should You Consider When Choosing a Passwordless Solution?

As a business owner or developer of an application where authentication is one of the first steps for every new and returning customer, choosing the easiest and most secure login experience is crucial for your success. Today, more and more companies are looking for the best passwordless solution that meets customer preferences for simplicity and security while addressing business needs. Even within the passwordless category, there are many types of passwordless authentication methods. Some popular options to consider:

  • Email magic links – Users enter their email address to get a magic link or unique code to log in, proving possession of the email address appended to their account.

  • SMS OTPs – Entering a phone number is required to get a unique one-time passcode to log in, proving possession of the phone appended to their account.

  • Biometric authenticationThe gold standard of passwordless authentication, fingerprint or facial biometrics offer physical proof of the user’s identity to gain account access with an elevated level of trust.

Identifying your needs and priorities

Before making a decision on which passwordless customer authentication solution is right for you, think about the various considerations that are unique to your industry, business and customers.

Customer experience vs. security

Usually when asked if customer experience (CX) or security is more important, it’s tough for a business owner to answer because, in many cases, they’re equally important. Maybe you need a solution that gives you the best of both. The problem is most customer identity and access management (CIAM) solutions will ask you to compromise or “balance” the two as if security and CX are mutually exclusive. Having to make a tradeoff was indeed the reality until recent advances by the FIDO (Fast ID Online) Alliance. I’ll get to that, but first…

Think about the details of your business and your customers’ behavior:

  • Are you in a highly regulated industry where security and privacy are paramount?
  • Do you have a high volume of one-time visitors or frequently-visiting customers?
  • Do you have a high rate of customer drop-offs at registration or at login?
  • How much friction will your customers tolerate?
  • Do your customers have a preference for security or ease? If they have a preference, which one wins?

The answer to the last question may feel like Sophia’s Choice, but these are the details that will dictate what kind of authentication solution is the right one for you.

For instance, if you want a more security-focused experience and aren’t worried about adding friction, you may opt to use SMS OTP, an authenticator app TOTP or magic links. Keep in mind however, all of these involve using shared secrets that can be phished, intercepted or compromised. And quite often, they are used as a second factor on top of passwords — your #1 risk that passwordless should eliminate.

If you care more about the CX and less about security, you may be content to the status quote of using passwords. I just encourage you to consider how much that’s costing you. 63% of consumers say they wouldn’t return to a website if they had fraud concerns, according to TransUnion’s 2022 Global Fraud Trends Report.

The same report shows:

  • 43% of consumers have abandoned an online form because they didn’t think their personal data was secure.
  • 78% of respondents say they want to be “highly confident” their personal data would not be compromised before transacting with a business online.

These stats reveal that the mere perception of fraud risk can sway a consumer’s decision when selecting a digital service. The real question is, do you want to choose between CX and security? If you want to optimize both, look for a solution that enables in-app push notifications, WebAuthn and/or device biometrics.

Mobile vs. desktop users

Another question to ask: what are your customer’s preferred channels? Collecting the right telemetry to know where they are coming from so that you can build an optimized experience for them is critical. Plus, the more dynamic and insightful your solution is, the better. For example, your solution should know which of your customers have devices that support FIDO-based on-device biometric authentication and which ones do not.

If your customers tend to use desktop first, you may want to select in-app push notifications and/or an authenticator app TOTP. If you mostly have mobile-first customers, you may prefer OAuth, WebAuthn or device biometrics.

User identifier

How essential is it for your business to collect or know a customer UID or user records? These can include phone numbers, emails and/or social security numbers. There are industries such as fintech, healthcare and travel where this information is required for the authentication flow. Point being, there are many different user record requirements that can have an impact on the authentication method(s) you offer.

App-based vs. app-less

A sophisticated solution should be able to leverage the technology your customers already have when they are registering or logging in to your domain. Namely, do they already have a client-side app downloaded to their device or are they using the web?

Here again, consider what percentage of your customers already have biometric-enabled devices.

An estimated 80% of active phones in North America, Asia and Western Europe have biometric capabilities.

— Statista

Does this represent a large percentage of your customer base?

Requiring the registration to go through an app can be an extra layer of security business owners may prefer. But that extra layer also requires an extra step for the customers who must be willing to download the app. An app-less passwordless solution could lower a barrier to entry and improve your passwordless adoption rates.

Device bound vs. device agnostic

Businesses may want a solution that can automatically recognize if the customer’s particular device can be used for a particular method of registration, authentication or authorization. For added security, a business may want to require that only a specific app (one supplied by the organization) is allowed.

Business sectors

The next question is how does your business think about these passwordless requirements when applied across your various business segments? For example, you may work at a very large company that caters to different types of customers. Disney, for example, owns theme parks and media companies, including Disney Jr. and the History Channel. They must meet a broad range of customer preferences, ways of engaging with technology and devices customers of all ages and demographics use.

All of them have an interest in CX and security, but some lean one way more than others. Verticals, like retail and customer software, may have high priorities on a mobile apps and performance to scale for millions of customers to prevent churn. According to Google, when a page load time is delayed by 1 to 3 seconds, bounce rates increase by 32% and by 90% when the page load time takes up to 5 seconds.

B2B and healthcare, on the other hand, emphasize desktop computers (yes, they still exist) and security (always important) because of regulatory compliance and low churn rates.

Some key questions to ask:

  • How frequently will the user return to your app or service?
  • Which devices do your users use (mobile, laptop or desktop; new or outdated)?
  • What is the total cost of an account takeover (chargebacks, customer service calls, compliance fines, brand damage and lost customer confidence)?
  • What is the cost of loosing a customer to too much friction either in registration or authentication?

Transmit Security WebAuthn Solutions

The most efficient solution for your business will depend on your answers to the considerations above. But if you’d like to have both — better CX and security — look for a WebAuthn solution. Here’s why. First, WebAuthn, a core component of FIDO2 specifications, is a web-based API that allows you to update your websites’ login pages to add FIDO-based authentication on all supported browsers and platforms. It’s particularly important to find a solution that makes it easier for developers to make use of WebAuthn.

Transmit Security Passwordless & MFA cloud-native service provides two approaches for building WebAuthn experiences:

  • APIs through our SDK – The SDK does all the heavy lifting to provide secure WebAuthn passwordless authentication while giving you the flexibility to control the authentication logic and user experience. This enables developers to bring their own, customized experience and branded UI to their solution.

  • Plug-and-Play (coming soon) – Use a single API call to get complete user flows out of the box. With this low-code option, there is no need for testing or maintenance requirements with full logic and UI ready to go.

Discover more about how Transmit Security’s true passwordless authentication can help you eradicate or phase out passwords over time. First, you must start with a solution that can completely remove passwords from the complete customer journey.

If you lose your device, most passwordless solutions will ask you to recover your account by logging in with a password. If passwords lurk anywhere in the shadows, you’re still at risk of password compromise that leads to account takeover (ATO) fraud.

Put an end to the age-old compromise between CX and security by exploring our Passwordless & MFA service or our complete CIAM platform. Need more tips? Read our Passwordless Buyer’s Guide.


  • Daniel McCorriston, Senior Product Marketing Manager

    Dan McCorriston is a Senior Product Marketing Manager for Transmit Security. He is passionate about technology, collaborating with developers, and creating new methods of expanding technology education. Out of the office he likes to hike, cook and spend time with his family.

  • Danny Kadyshevitch, Senior Product Manager

    Danny Kadyshevitch is a Senior Product Manager at Transmit Security previously building and leading product management for the company's Passwordless and MFA Services and is now running PM for Account Protection Services. Prior to Transmit Security, Danny has an essential experience in the domain of cyber security, after serving in the 8200 intelligence unit of IDF and spending 7 years in Microsoft's Cloud Security division.