Your personal Microsoft account (for Outlook.com, Xbox, OneDrive or Windows) can go without a password. You then sign in with the Microsoft Authenticator app, Windows Hello, a passkey or a code by email or text. Without a password, there's nothing that can be stolen, guessed or tricked out of you in a phishing email. This article shows how to convert an existing account and what to watch out for.
Why go without a password?
Passwords get reused, leaked and captured through fake sign-in pages. With passwordless sign-in you prove who you are with something you have (your phone or PC) and something you are or know (your fingerprint, face or PIN). That is essentially Multi-Factor Authentication in a single step. Microsoft now makes new personal accounts passwordless by default and encourages passkeys. Don't have an account yet? Read how to create a free Microsoft account.
What is a passkey?
A passkey is a digital key stored on your device, for example in Windows Hello, in your iPhone's keychain or in Google Password Manager. You unlock it with your face, fingerprint or PIN. A passkey only works on Microsoft's real website, so phishing doesn't stand a chance.
Prepare
- Install Microsoft Authenticator on your phone and add your personal Microsoft account.
- Or set up a passkey with Windows Hello, your phone or a security key. On account.microsoft.com, go to Security > Manage how I sign in > Add a new way to sign in or verify and choose the option for face, fingerprint, PIN or security key.
- Check your recovery info: a second email address and a phone number that you actually use.
Remove your password
- Go to account.microsoft.com and sign in.
- Choose Security > Advanced security options (or Manage how I sign in). Menu names can differ slightly.
- Turn on Passwordless account.
- Approve the notification in the Authenticator app.
From now on, when you sign in you get a notification on your phone, or Windows asks for your face, fingerprint or PIN.
What to watch out for
- Make sure you have a recovery method: a second email address or phone number, or a second passkey. If you lose your only phone without an alternative, recovering your account becomes a lengthy procedure.
- Generate a recovery code in the advanced security options and keep it on paper or in a password manager.
- Some older apps and devices (such as an old Xbox 360) still ask for a password. Use an app password there.
- Check now and then where and when your account was signed in to, in the recent activity of your account.
- Want to go back? You can set a password again later.
Frequently asked questions
I don't get a notification in Authenticator. Open the app itself: the request often appears anyway. Also check that notifications for the app are on and that the time on your phone is set automatically.
I have a new phone. Set up Authenticator on the new device and add your account before you wipe the old phone. A passkey in your iCloud or Google keychain usually moves along automatically. On Apple devices, read how to sign in to iCloud.com with a passkey.
Can I still sign in on someone else's PC? Yes, choose a notification on your phone, a code by email or text, or scan the QR code with your phone to use your passkey.
And at work?
For work accounts, your admin turns on passwordless sign-in. Your personal setting has no effect there. Read passwordless sign-in in Microsoft 365, and for admins, how to enable MFA in Microsoft 365.
Nederlandstalige versie: Je persoonlijke Microsoft-account gebruiken zonder wachtwoord