Passwordless Login: What It Is and How It Works for Loyalty
By Alva Chew · Updated
Definition Passwordless login is any way of signing in that does not ask the customer to create, remember or type a password. The common methods are an emailed one-tap link, a one-time code and a passkey. For a loyalty programme, an email link is the simplest, because the customer joins once by scanning a QR code and later signs in with one tap.
What is passwordless login?
Passwordless login is a way for a customer to sign in without a password. They never choose one, remember one or type one. Instead they prove who they are through something they already have, such as their email inbox or their phone.
For a shop, the point is practical. A loyalty card that asks for a password at the counter adds a step the customer has to finish while a queue waits behind them.
What are the main passwordless methods?
| Method | How the customer signs in | What you should know |
|---|---|---|
| Email link | Taps a single-use link sent to their email | Needs only an email address. Safety depends on the inbox. |
| One-time code | Types a short code sent by email or text | One more step than a link. Codes can be intercepted. |
| Passkey | Opens a key on their phone with a fingerprint, face or screen lock | Phishing resistant. Needs setup on the device. |
The FIDO Alliance, the industry body behind the passkey standard, describes passkeys as phishing resistant and based on public key cryptography. Source: FIDO Alliance, Passkeys, checked 7 November 2026.
What does NIST say about passwords and email sign-in?
NIST is the US standards body whose digital identity guidelines many governments and security teams follow. Its current guidance, SP 800-63B in the 800-63-4 series, says the following.
- “Passwords are not phishing-resistant.”
- Passwords used as a single factor must be at least 15 characters, and verifiers must not force periodic changes or impose other composition rules.
- “Email SHALL NOT be used for out-of-band authentication” because it can be intercepted in transit or reached with only a password.
- Confirmation codes sent to validate an email address are not authentication processes and are outside that prohibition.
- An out-of-band authentication is invalid unless completed within 10 minutes.
Source: NIST SP 800-63B, Digital Identity Guidelines, sections 3.1.1 and 3.1.3, page dated 26 August 2025, checked 7 November 2026.
These rules are written for systems that guard high-value accounts. A loyalty card holds a points balance, so the stakes are lower. Still, the text shows the trade-off: an emailed link is easy but not phishing resistant, and a passkey is stronger but takes more setup.
Why do passwords cause trouble at the counter?
A password asks the customer to invent a secret, remember it and retype it on a small screen. Many forget it, so you then need a reset flow, and every reset is a chance for the customer to give up. Customers who cannot get back into a card also cannot see or redeem the points you gave them.
A shop with a short sign-up asks for less. The customer scans a QR code, enters an email address and has a card. Nothing to remember means nothing to forget.
Does passwordless login need an app?
No. An emailed link opens in the phone’s browser. A passkey is stored and opened by the phone itself. Neither needs your customer to install anything, which is why passwordless login fits a loyalty card with no app download.
What should a shop do with the email address?
The address the customer enters to sign in is also contact data they chose to give you. It belongs to your own customer list, so it counts as first-party data. Use it for the programme the customer joined and keep the sign-up wording clear about that.
Which method suits a points-only loyalty programme?
An email link suits most shops. A points-only programme works because customers already understand spend, earn and redeem, and the login should be as simple as the reward. Adding a password, a security question or a second app adds rules the customer must learn, in the way stamps, tiers and vouchers do on the reward side.
Passkeys are a good addition where your system supports them. If your programme holds nothing of value beyond a points balance, a one-tap email link is a proportionate choice.
Passwordless login and Gimify
Gimify members join by scanning a QR code and entering their email, with no form, no app download and no password. Members sign in afterwards with a one-tap email link, and their card sits in Google Wallet with a live balance. See also digital loyalty card for how the card itself works.
Questions owners ask
What is passwordless login?
A sign-in method that never asks the customer for a password. They prove who they are with something else, such as a link sent to their email, a one-time code or a passkey stored on their phone.
Is passwordless login secure?
It removes the password, which NIST says is not phishing-resistant. Methods differ though. A passkey is phishing resistant, while an emailed link depends on the customer's email account staying secure.
What is the difference between an email link and a passkey?
An email link is a single-use link sent to the customer's email. A passkey is a cryptographic key kept on the customer's device and opened with a fingerprint, face or screen lock.
Does passwordless login suit a small shop loyalty programme?
Yes, for most shops. A customer at the counter will not set up a password for a coffee card. An email link asks only for the address they already use.
Do customers need an app for passwordless login?
No. An emailed link opens in the phone's browser, and a passkey is handled by the phone itself. Neither needs a separate app from your shop.
Does passwordless login lower sign-up friction?
It removes one step, the password field. Fewer fields at the till means fewer customers walking away before the card exists.
Read next
Start free
Gimify is free for one outlet with unlimited members and no time limit. Unlimited outlets are one flat monthly price.
See plans