Microsoft supports passwordless login on Windows, Android and iOS

All users can now log in to their Microsoft account by creating a pass-key across Windows, Androids or iOS platforms. This change will make it easier for users to sign in to their Microsoft account without needing to enter a password.

Currently, users can create a key code for a Microsoft account with the option to secure their face, fingerprint, PIN code or security key to use to log in with another device.

'You can now use your key to log into Microsoft applications or websites, including Microsoft 365 or Copilot packages on desktop browsers and mobile devices,' Vasu Jakkal, corporate vice president said the head of security and compliance. 'In the coming weeks, we will release a mobile version of app login with a passcode.'

The key code, or pass-key, is Microsoft's important effort towards a password-free future. Previously in 2015, the software giant first introduced facial, fingerprint or PIN authentication methods with Windows Hello on the Win 10 operating system. Next, the company expanded support for security keys FIDO in April 2018 before moving to a completely passwordless option on Microsoft accounts in 2021.

Passkey is developed based on the WebAuthentication (WebAuthn) standard, in principle an asymmetric encryption method "public key - private key" used in blockchains. In this, a key is stored by the website or service where the account is located, and a private key is stored on the device the user uses to verify identity.

For example, users can log into their Gmail, PayPal, or iCloud accounts simply by activating Face ID on their iPhone, their Android phone's fingerprint sensor, or with Windows Hello on their PC.

Pass-key is becoming a technology industry standard, adopted by Apple, Google, Microsoft and other technology companies. To date, more than 400 million Google accounts are using this login method.

In general, passkey will help prevent the risk of fraud and password theft. Passkey keeps the private key on the device so it cannot be leaked on the network environment.

Additionally, in case the device is damaged or lost, users can still log in because the passcode works with many different devices. At the same time, services that support key codes will also re-authenticate the phone number or email address or hardware security key (if available).

Kareem Winters

Update 03 May 2024