As the most popular means of user verification in digital identities, for decades, user verification was a password system with several issues, mostly stemming from the risk of credential dumping, password reuse, and large-scale credential breaches, as well as from the possibility of phishing attacks [1]. But even with so many holes exposed, small, medium, and large-sized organizations are struggling with continuous security issues because of poor credential security management practices and poor security practices of employees. Cloud computing, Internet of Things (IoT) devices, mobile apps, and digital distributed services are rapidly expanding in number, a growth that requires scalable, secure, and user-friendly authentication mechanisms. In this regard, among the various possibilities that are emerging, there is authentication based on a public-key cryptographic system, authentication by a biometric feature, authentication by an authentication hardware key pair, and authentication based on the authenticator located in the device. This is called passwordless authentication as it does not involve sharing of secrets. The FIDO2 and WebAuthn standards provide enhanced security and protection against phishing, credential hijacking, and replay attacks and are more convenient and efficient to use for authentication [2]. For this review, the term “large-scale identity systems” refers to enterprise, government, and consumer identity systems that are able to prove the identity of thousands to millions of users in a set of distributed identity worlds. They are the percentage changes of user/organisation between the switch from being password authenticated to passwordless, and the impact of security, which is measurable in terms of activity, for example, reduction in the number of phishing events, number of credentials stolen, number of password reset attempts, user/authentication failure, operation failure, overhead, etc. [3][4]. A key gap in the literature is the limited empirical evidence on how passwordless authentication performs at scale in real-world settings and in multi-factor authentication (MFA) systems. This review aims to identify the adoption rates and security performance of passwordless authentication in large-scale identity solutions.

In this research, a structured literature research method was chosen to collect a variety of literature sources related to security in the system of “without password” authentication in enterprise and consumer identity systems. Comprehensive electronic searches were conducted in IEEE Xplore, ACM Digital Library, Scopus, Springer Link, ScienceDirect, and Google Scholar, and relevant publications in the last 8 years (2018-2025) were identified. Searching was done with some of the combinations, such as passwordless authentication, FIDO2, WebAuthn, passkeys, authentication security, identity management, biometric authentication, multi-factor authentication (MFA), search for Technology Acceptance Model (TAM), search for enterprise authentication, and search for consumer identity systems. A preliminary search was made to identify ~185 publications, which was made possible by this. The full text of 112 papers was analyzed; 28 papers were duplicate studies, and 28 papers were screened on the basis of their title and abstract. Of the publications selected, based on the inclusion/exclusion criteria, 52 were analyzed in more depth using a qualitative analysis method. The papers surveyed included presented papers from peer-reviewed journals, conference proceedings, industrial case studies, standards papers, or technical reports that provided empirical data, implementation experiences, usability studies, trends, or information about the adoption of a security outcome that has some relevance to the use of passwords. Studies that just included the traditional password system, opinion articles or editorials, duplicate studies, non-English publications, and studies where the method used was not described in enough detail to be used were excluded. Data gathered from the studies included: Deployment-Enterprise vs Consumer, Authentication Technology-FIDO2, WebAuthn, Passkeys, Windows Hello; Evaluation Methodology, Security Characteristics, Challenges Faced, and Metrics Obtained.

Studies were compiled across five themes: authentication technologies and standards, acceptance and adoption by users, measurable impacts of security, concerns during deployment and interoperability, and the directions of future studies. The studies were categorized into the following broad categories: technologies and standards for authentication, technologies and standards for user acceptance and adoption, measurable impacts of security, deployment challenges and interoperability, and future research directions. The values of Table 1 and of Figure 2 were synthesized; the other values, from representative results reported throughout the literature, presently in use, and from case studies in the public domain for the industry, were used for comparative analyses. These studies are not a formal meta-analysis, but rather they are listed to indicate a general trend: they had varying sizes, types of evaluation, developmental levels of evaluations, and whether they reported metrics of the evaluations. The framework approach makes it easy to ensure a clear, repeatable, and unbiased review, thereby allowing a thorough review of the state of the art, how passwordless authentication development can be implemented, and future opportunities.

Digital authentication has traversed amazing cycles, each of which is driven by a distinct technology. Digital authentication has come a long way over the years as cybersecurity issues have evolved, and the importance of secure digital identity credentialing has increased. For decades, for ease of use, low implementation expense, and compatibility, traditional username-and-password authentication was the prevailing method of authentication. But passwords have become a weak security measure in the face of the growing number of phishing attacks, credential stuffing, password reuse, and big data breaches [5]. To reduce these risks, organizations came up with Multi-Factor Authentication (MFA), which combines passwords with other authentication factors (one-time password (OTP), biometric, hardware security tokens, or mobile authenticators). MFA is a very good solution to prevent credential-based attacks, but it is also more complex, burdening the admin and causing user friction, particularly in an enterprise environment with thousands or millions of users requiring access to a resource. Passwordless authentication is the next step in authentication evolution, as hidden secrets can be replaced by cryptographic credentials, which are not vulnerable to phishing and credential theft. Public-key techniques like FIDO2, WebAuthn, and Passkeys use public-key cryptography where the private part is securely kept on user devices and only the public part is registered to the service provider [6]. They use trusted representations from the area, such as biometrics or PIN codes of devices for authentication, and they don’t send reusable representations over communications pathways. This design significantly decreases the potential for password cracking and provides increased ease of login, turnaround time, and efficiency during operations. Based on the Technology Acceptance Model (TAM), people’s acceptance of a particular technology is mainly driven by two factors: Perceived Usefulness (PU) and Perceived Ease of Use (PEOU). Some aspects of passwordless authentication include perceived usefulness, which means users feel that the use of an authentication tool where they don’t have to remember their own passwords provides them additional security, reduces authentication failure rates, increases ease of use when dealing with the management of authentication credentials, and blocks phishing attacks. The Ease of Use concept is a measure of how easily biometric authentication, passkeys, and hardware security devices are used when used normally in the system [7]. These are concepts that are applied throughout this review as a guideline for art analysis. The businesses featured in Section 4 prove that companies that saw fewer password resets, less complex management, and higher phishing protection had a higher adoption rate. Likewise, seamless authentication experiences and the lack of doubts in device-bound credentials have a positive impact on usage, as seen by consumer deployments. Yet privacy concerns, loss of interoperability and recovery of credentials, and device limitations have lowered the perceived value and trust, despite the technical advantages of the passwordless authentication paradigm, reducing the uptake of implementations. As seen in Figure 1, over the years, different kinds of authentication technologies have evolved, starting with passwords and moving to multi-factor authentication, and on to the newer passwordless authentication technologies. It illustrates the gradual development from knowledge-based authentication techniques to more cryptographic, biometric, and hardware-based authentication techniques to address increasing security demands, user-friendliness, and scalability requirements for enterprise and consumer identity systems.

While not using TAM is the first concept to keep in mind when implementing the concept of no password, there’s another concept that can’t be overstated: usability. The authentication mechanisms need to be secure enough not to be a burden on cognitive load, as well as the amount of time or effort it takes to log in to the system, and would need to be easily recoverable in case of lost device/replacement of authentication elements. Empirical research has shown that passwordless authentication can help decrease password reset rates [8] and the time needed to fulfill the authentication process, increase satisfaction among users, and is less tedious than the traditional password authentication process. But true deployment challenges include cross-platform support, dealing with the various legacy systems, recouping credentials (when lost), putting hardware in place, and local legislation. They are different challenges, depending on the context: enterprise: access to locking is less of a focus than it should be; it’s more about being efficient and useful to them; consumer: less about locking than it should be about being convenient and being usable; it’s about privacy and about syncing cross devices. Technically robust deployment integrity is acceptable; however, the scale of deployment, user interest, and organization readiness play significant roles in deployment considerations. The user authentication schemes used have changed from simple password-based schemes to schemes that involve some cryptographic elements, or schemes that require no password, and have gotten more involved in what they consider the “right” level of security, all the while maintaining some reasonable level of usability and operating efficiency, as in Figure 1. These are “flavored” views and concepts which provide the context to interpret the conceptualization of the process of enterprise and consumer adoption of the patterns discussed in Section 4 and the measurement of security outcomes in Section 5.

Figure 1.Evolution of authentication methods.

Over the last five years, the trend of eliminating passwords has picked up significantly, as many organisations recognize the failure of password-based authentication to keep up with the challenges of today’s digital infrastructures. With the ubiquity of FIDO2, WebAuthn and Passkeys, people can log in without relying on more vulnerable password-based logins without any risk of them being compromised or stolen, and without risk from phishing, credential theft or account takeover attacks [9]. Adoption patterns vary, though, from one business tier to another (enterprise versus consumer) because goals for deployment, constraints, and regulations differ from tier to tier and expectations differ among consumers and users, as well.

Assessing the security effect of passwordless authentication goes beyond just the technical aspects of enhanced security and involves quantifying with performance metrics and then using qualitative metrics to assess results. Phishing instances and reports of credential theft, requests for password reset, authentication success rates, login completion time, account takeover attempts, and the cost of support transactions to the helpdesk are among the more popular quantitative statistics. Qualitative statistics focus on usability, trust, accessibility, and administrative efficiency of users. When moving towards passwordless authentication, other factors like cryptographic assurance, device integrity validation, phishing resistance, and resiliency to replay attacks have become necessary to evaluate the effectiveness of the system [13]. Every enterprise deployment of FIDO2, WebAuthn, and Passkeys speaks to the fact that reusables are being removed from the authentication process, and the results have measurable positive effects on improving authentication security. In the large-scale deployments reported by studies involving Microsoft, Google, Okta, and others, the number of phishing attacks, password reset requests, credential compromises, and authentication failures has been reduced after adopting passwordless authentication [10]-[12][14]. The improvements are explained by the fact that public-key cryptography keeps the private keys in trusted hardware where they are never delivered or revealed in authentication, which greatly diminishes the chances for both credential capture and replay (recording and replaying an authentication) from occurring. Furthermore, comparative studies show that passwordless authentication is more resistant to phishing attacks, adverse in-the-middle attacks, and credential stuffing attacks than traditional password-based Multi-Factor Authentication (MFA) methods, and that it enhances user convenience and reduces the administrative burden [15]. Even though passwordless authentication can offer technological benefits, it also presents new implementation issues such as representation attacks, loss of device, synchronization, and recovery, along with security mechanisms like adaptive authentication, behavioral analytics, continuous device trust assessment, and risk-based access policies [16]. The authors were able to distill some representative security enhancements from the reviewed enterprise and consumer case studies into an overall summary (Figure 2). Where published literature and industrial deployment data exist, the comparative values are used to illustrate overall security

Figure 2.Representative security impact comparison before and after passwordless authentication deployment.

trends, and not results from a single experimental data set. As each of the reviewed studies has varying levels of deployments, evaluation approaches, numbers of evaluators, and the duration of the lift period, the values presented herein are intended to provide a foundation for evidence that, overall, passwordless authentication can reduce the incidence of compromises and enhance an organization’s security and operational efficiency.

In the absence of global identity systems, there are some challenges in making passwordless authentication more convenient for users to perform what they need. The most critical issue is how to handle devices and keys. In a passwordless system, a private key is typically stored on trusted local machines. This re-enrolment/recovery process will be difficult if these types of devices are lost or replaced due to user actions, and it will affect their usability and security [17]. Furthermore, legacy solutions become hard to interoperate with other passwordless authentication solutions, such as Single Sign-On (SSO) and Federated ID. Protocols like FIDO2 and WebAuthn will offer privacy and security, but there are inconsistencies in their ability to be used across browsers, platforms and devices that pose a range of challenges for interoperability [18]. Other sets of stringent rules include User consent, data minimisation and authentication levels under regulatory frameworks like GDPR, HIPAA and PSD2. These are conflicting legal and technical obligations, and can be difficult to meet in order to increase uptake. Biometric systems and biometric hardware authenticators prove to be more convenient to use. So, there are certain types of people who aren’t persuaded by biometric systems and hardware authenticators. The issue of perceived transparency and of users’ confidence in the use of new authentication technologies has been identified as one of the most important topics [19]. So it’s not just technically possible; it can’t be effectively applied on a large scale unless there’s an effort to educate people on the subject of making their personal data more secure with passwordless systems. Comparable to that, services and solutions that use AI, such as passwordless authentication and new solutions like DID decentralized identity, have tremendous potential in ushering us towards a passwordless world. Using AI, adaptive authentication can rely on contextual data to make more accurate decisions by analyzing how the user is using the device, verifying device integrity, and identifying anomalies on the network. A blockchain-based identity management architecture can enable decentralized identity platforms to help humans manage their identity without relying on a centralized entity, thereby reducing vulnerability [20]. The changes mentioned above will be future developments in the elaboration of Passwordless systems. It’s already smart, privacy-enabling, and autonomous identity systems, transcending the whole world of authentication.

The digital identity system can offer a couple of handy enhancements to the basic flaws of passwords: passwordless authentication and passwordless authentication keys. Businesses and research have made significant advancements in user satisfaction and credential security, and in measurable resistance to phishing attacks. Problems with interoperability, equipment costs, and more stringent security and privacy protocols have restricted the use of the field. If an appropriate quantified solution can be developed and conscientiousness can be created among users so that digital transformation can be scaled, then cooperation between the technology providers in both the discourse space and at the organizational level is crucial. Alongside passwordless security, these possible technologies like artificial intelligence and decentralized identity architectures will enable flexible and self-sovereign authentication as well. The passwordless user experience, its robust security features and convenience, makes it a promising solution for securing and authenticating users in the future of authentication and security management.