Towards Passwordless Authentication: A Practitioner-Grounded, Risk-Tiered Framework for Phased Hybrid Transition

Despite the advances in two-factor and biometric authentication techniques, systems de signers, application developers, and organizations continue to rely on passwords despite the phishing resistance of origin-bound public-key credentials. This study examines whether ap plication/systems designers should eliminate passwords or retain them within layered security architectures. Using qualitative analysis, the study examined an asynchronous discussion involving 28 middle- and senior-level IT managers, yielding 40 unique contributions and 16 original positional statements. These positions were compared with 36 scholarly studies published between 2021 and 2026 and relevant standards and guidance from NIST, the Software Engineering Institute, ISO/IEC, the PCI Security Standards Council, CISA, and European regulators. None of the 16 statements supported immediate password elimination, while 13 endorsed a phased transition prioritizing phishing-resistant authentication and retaining passwords as time-limited fallbacks for legacy systems, recovery, and exceptions. Recovery, regulatory compliance, legacy compatibility, and implementation costs dominated practitioners’ concerns, although cost allocation remained unresolved. Findings indicate that residual risks concentrate in recovery mechanisms, weaker secondary factors, and continuity failures rather than credential cryptography. The study introduces a recovery-assurance rule requiring recovery mechanisms to meet or exceed sign-in assurance and distinguishes peer-level password options from expiring exceptions. It proposes the Risk-Tiered Passwordless Transition Framework (RT-PTF), aligning four risk tiers with NIST SP 800-63-4 assurance levels and deriving six testable propositions.