What it means
Multi-factor authentication adds a second step on top of a password, while passwordless authentication removes the password itself. The most common standard is the passkey, where a private key stays on the user's device and the service stores only a matching public key. Magic links and one-time codes sent by email or text are also called passwordless, but they are weaker because they depend on the inbox or phone number.
Why it matters when you buy software
Passwordless sign-in is often limited to higher plan tiers or sold as an add-on. Check whether it is available to every user, whether passwords can be switched off completely or remain as a fallback, and whether it works with single sign-on. Also check how an account is recovered when a device is lost, because recovery decides how secure the setup really is.
How it works in practice
The service sends a challenge to the user's device. The user approves it with a fingerprint, face scan or PIN, and the device signs the challenge with its private key. No reusable secret crosses the network, so phishing and credential stuffing have little to steal. Lost devices and weak recovery paths remain the main risk.
See also: Directory sync, MFA and the glossary index.