# Phishing-resistant authentication. Nothing to type into a fake page. > Phishing-resistant authentication for your workforce. Each device holds its own key instead of a password or code, so fake pages have nothing to collect. Markdown version of . Last updated 2026-10-05. Each employee’s device holds its own key, and that key signs only for your real sign-in page. A copied page or a fake caller gets nothing. Rolls out through Microsoft Entra ID or Google Workspace. ## What makes a sign-in phishing-resistant? Nothing in it can be handed over. Phishing-resistant authentication gives a fake page or a fake caller nothing to reuse: each device holds its own key instead of a password or a code. - **No password to catch**: There isn’t one to type, reuse or reset. - **A key that stays on the device**: Never exported or copied. A biometric or device PIN unlocks it. - **It signs for your sites only**: A lookalike or a relay gets a refusal, not a proof. ## Four ways sign-ins get phished. None of them gets a key. At Fernhill Insurance: where each trick shows up, and where it stops. - It passes each step to the real site as it happens. Mei’s key sees the wrong address and won’t sign. - Someone posing as IT asks Mei to read out a code. Her everyday sign-in doesn’t use one. - Prompt after prompt, hoping for a tired yes. Each one shows where it came from. - A caller asks IT to reset Mei’s sign-in. The desk checks with her own device first. ## Keep the directory you have. Change only the proof. Microsoft Entra ID or Google Workspace hands sign-in to Hawcx. Your apps and access rules stay as they are. - **Same apps, no password**: Employees open their apps as before. The sign-in step runs on their own device. - **One key per device**: IT sees every device and its key, and removes a lost one without a reset. ## Phishing-resistant authentication, answered - [Passwordless authentication](https://www.hawcx.com/passwordless) - [Passwordless SSO for your workforce](https://www.hawcx.com/blog/hawcx-passwordless-sso-federation-the-next-evolution-of-enterprise-single-sign-on) ### What is phishing-resistant authentication? It’s sign-in that leaves nothing a person types, reads out or approves for whoever tricked them into it. Instead of a password or a one-time code, it relies on a key held on the person’s device and tied to the site. With Hawcx, each employee’s device makes its own key, unlocked with a biometric or device PIN. ### Does Hawcx stop adversary-in-the-middle phishing? Yes, at sign-in. A relay page sits between the employee and the real site and passes each step through as it happens. Hawcx keys sign only for the real site, so the relay gets nothing it can reuse. A session stolen after sign-in is a separate risk, handled by how your apps issue and expire sessions. ### Do we have to replace Microsoft Entra ID or Google Workspace? No. Hawcx acts as a passwordless SAML identity provider federated with Microsoft Entra ID or Google Workspace. Your directory still decides who can open which app; Hawcx changes how people prove it’s them. A few sign-ins may still use a password after federation, such as unlocking the laptop itself. ### What happens when an employee gets a new phone or laptop? The new device is checked once, then makes its own key. You choose how that check works: an approval on a device they already use, a QR scan, or a one-time code. Codes are what a phisher asks for, so many teams keep them for recovery only. A lost device’s key can be removed without touching the others. ### Does Hawcx use passkeys or FIDO2? No. Hawcx runs its own protocol: each device makes its own key, which never leaves it or syncs to another device. If you must meet a specific standard, talk to us about what Hawcx covers before you rely on it. ### Do we still need phishing training? Yes. Hawcx protects the sign-in, but many lures ask people to pay an invoice, share a file or install software, which no sign-in method can check. What changes is that a convincing sign-in page gets nothing to use, so training can focus on the lures that remain. ## Give phishing nothing to collect. Start with the people it targets. - More sign-in use cases - [Workforce SSO](https://www.hawcx.com/blog/hawcx-passwordless-sso-federation-the-next-evolution-of-enterprise-single-sign-on) - [Customer login](https://www.hawcx.com/passwordless/customers)