# Passwordless authentication. Verify once, then just sign in. > Passwordless authentication with phishing-resistant device keys. People verify once with a code, QR scan or push, then Hawcx signs them in automatically. Markdown version of . Last updated 2026-10-07. People verify once, with a code, a QR scan or a push. From then on their device signs them in with its own phishing-resistant key, automatically. Hawcx asks for MFA again only when a risk rule trips. Verify once. This device is trusted from then on. Hawcx checks the risk and signs Jordan in. Far from usual, so Hawcx asks for MFA. ## Everything around sign-in. In one dashboard. Verification methods, automatic sign-in, audit logs, analytics and a risk engine, in one console. Sign-in flow: Pick the verification methods. Trusted devices sign in automatically and skip MFA. Audit logs: Every change to your team, projects and sign-in flow, with who made it. Analytics: Logins, daily and monthly active users, platforms and locations, for each app. Risk engine: Too many tries, a far-away sign-in or impossible travel, and Hawcx asks for MFA. ## Why it’s automatic. A key on every device. After someone verifies, their device makes its own key and proves every sign-in with it. Known devices skip MFA, unless a risk rule trips. ## What’s in Hawcx passwordless. Keys, MFA and recovery. Everything between a person and their account, for the apps your customers use and the ones your employees open every day. ### Phishing-resistant device keys Each device makes its own key in the Secure Enclave, TEE or WebCrypto. The private key never leaves it, so on a trusted device there’s no password or code for a fake page to collect. ### [Automatic sign-in](https://www.hawcx.com/passwordless/customers) Once a device is trusted, Hawcx signs people in on their own, until a risk rule asks for more. ### MFA when it matters Email and SMS codes, QR approval and push, on a new device or when a risk rule trips. ### Devices and recovery Revoke a lost phone in one click. People recover with a code or a magic link, and the new device makes a new key. ### Step-up for sensitive actions Ask for a fresh check before someone changes their email, exports data or updates billing. ### [SDKs for web, mobile and server](https://docs.hawcx.com) Add passwordless to the app you have, with a WordPress plugin for WordPress and WooCommerce sites. ### [Passwordless SSO for employees](https://www.hawcx.com/blog/hawcx-passwordless-sso-federation-the-next-evolution-of-enterprise-single-sign-on) Hawcx is a passwordless SAML identity provider for Microsoft Entra ID and Google Workspace, so employees open their work apps without a password. ## Passwordless for the enterprise. Less to steal. Less to reset. Hawcx removes the passwords your security team protects and your help desk resets, and fits the directory you already run. ### Nothing to steal from the server Hawcx keeps public keys, never passwords or shared secrets. A copy of your user store gives an attacker nothing to replay. ### No password resets There’s no password to forget, reset or rotate. People recover on their own with a code or a magic link. ### SSO with your directory Federate with Microsoft Entra ID or Google Workspace. Your directory still decides who gets access. ### Roles and audit logs Admin, Developer and Viewer roles for your team, and a log of every change to projects and the sign-in flow. ### Development and Production Build in Development today. Hawcx provisions Production with your team when you’re ready to launch. ## Get started with Hawcx passwordless. ### Book a demo See passwordless on your own app, with our team. ### Developers SDKs, quickstarts and code samples. ## Passwordless questions, answered. [Read the docs](https://docs.hawcx.com) ### What is passwordless authentication? Passwordless authentication signs people in without a password. With Hawcx, people verify once with an email or SMS code, a magic link, a QR scan or a push approval. Their device then makes its own key, and from then on Hawcx signs them in automatically, asking for MFA again only when a risk rule trips. ### How does Hawcx sign people in automatically? Each trusted device holds its own private key and proves every sign-in with it, so by default known devices skip MFA. Hawcx also runs risk rules on every sign-in: too many tries from one account or network, a sign-in from far away, or impossible travel. When a rule trips, Hawcx asks for a second factor. ### Which verification methods does Hawcx support? Email and SMS one-time codes, magic links, QR codes and push approvals. You choose which ones your app offers in the console. Hawcx asks for one on a new device, during recovery, when a risk rule trips, or before a sensitive action such as changing an email address. ### Is Hawcx passwordless authentication phishing-resistant? Everyday sign-ins use a key that never leaves the device, so on a trusted device there is no password or code for a fake page to collect. One-time codes and links can be phished, which is why Hawcx asks for them only on a new device, during recovery or when a risk rule trips. ### How is Hawcx passwordless authentication different from passkeys? Both replace passwords with public-key cryptography. Hawcx gives each device its own private key, which is never exported or shared, while synced passkeys depend on the sync services run by platforms and password managers. Hawcx works across iOS, Android and the web without waiting on browser vendors. ### Which platforms does Hawcx support? Hawcx has front-end SDKs for Web (@hawcx/react and @hawcx/core), Angular, iOS, Android, React Native and Flutter, back-end SDKs for Node.js, Python and Java, and a plugin for WordPress and WooCommerce sites. Each SDK is listed under [Hawcx SDKs](https://docs.hawcx.com). ### Does Hawcx work with Microsoft Entra ID and Google Workspace? Yes. For workforce sign-in, Hawcx acts as a passwordless SAML identity provider federated with Microsoft Entra ID or Google Workspace, so employees sign in to their apps without passwords. Your directory keeps deciding who gets access, and [passwordless SSO](https://www.hawcx.com/blog/hawcx-passwordless-sso-federation-the-next-evolution-of-enterprise-single-sign-on) leaves nothing for the help desk to reset or rotate. ## Verify once. Then just sign in. Running AI agents as well? [AI agent authentication](https://www.hawcx.com/ai-agents)