Sign-up without a password: what works, what fits.
A classic registration asks for a form, a password and a click in a confirmation email, and loses people at every step. This guide compares the ways to register without a password: social login, magic links, passkeys and reverse OTP, with what each needs and what it proves.
- Where registrations break off
- Four ways without a password
- An account with one message
Christian Schätzlein, Founder and developer of Sendity
3 min read
Where a classic registration breaks off
The steps of a password sign-up
-
Form Name, email, more fields Step 1
Every extra field is a reason to stop.
-
Password Rules, then repeat it Step 2
Twelve characters, one digit, one symbol: many stop here or reuse an old password.
-
Confirmation email Open the inbox, find the email Step 3
It lands in spam or arrives late, and the tab is closed by then.
-
Click the link Often on another device Step 4
Clicked on the phone, the sign-up continues in a different browser.
-
Next visit Password forgotten Later
The cycle starts again with a reset email.
Sign-ups by message. No form, no code.
Sendity is a sign-up widget for your website. Instead of filling in a form, your visitors send one short message via WhatsApp or email. Sendity checks who it came from and hands your site the name and the confirmed phone number or email address.
See how Sendity works →-
One message instead of a form Visitors tap send in WhatsApp or their email app. Nothing to type, no confirmation email to click.
-
Confirmed by the message itself The contact comes from the sender of the message, so typos and made-up addresses never reach your list.
-
Pay per confirmed contact Start with 1,000 free credits, no credit card. After that, prepaid packages with no subscription.
All of them remove the password. They differ in what the user needs and whether you end up with a verified contact.
Social login
Sign in with Google or Apple is fast. Not everyone wants to link these accounts, Apple can hide the real address behind a relay, and you depend on the provider.
Magic link
A sign-in link by email replaces the password and verifies the address. It keeps the email round trip, with spam folders and links opened on another device.
Passkeys
The strongest protection against phishing, stored on the device or in the password manager. A passkey proves the device, not a contact: for emails or calls you still need a verified address or number.
Reverse OTP
The visitor sends one prepared message by WhatsApp or email. That creates the account with a verified contact, and sending again signs them in later.
Combining them
For accounts with payments or sensitive data, add a passkey after the first sign-up. The verified contact stays your way back in if the device is lost.
An account with one message.
How registration and sign-in work with reverse OTP.
Register
The visitor sends one message. Your app creates the account with the verified number or address.
Come back
Sending again signs the user in. There is no password to forget.
Add a passkey
Optional, where the account protects money or sensitive data.
Password form or one message?
What the user does, from registration to the next visit.
| Aspect | Form with password | With Sendity |
|---|---|---|
| Fields | Name, email, password twice | None |
| Confirmation | Email with a link | Part of the sent message |
| Next visit | Remember the password or reset it | Send again |
| Stored on your side | Password hashes that can leak | No passwords |
What dropping the password changes.
Fewer steps for users, less to protect for you.
One step to the account
No form, no password rules, no confirmation email.
No passwords to leak
What you do not store cannot be stolen or reused elsewhere.
Verified from the start
Every account has a contact that has already sent you a message.
Live on your page in minutes.
Sendity runs as a compact widget on your page. Pick the path that fits your website.
Sign-up without a password: common questions.
Is that secure enough for a customer account?
For many accounts, yes. Where payments or sensitive data are involved, add a passkey, as with any code-based method.
Does every sign-in cost credits?
Yes, every successful verification counts, including sign-ins. A session in your app keeps users signed in between visits.
What if a user changes their number?
Let users add a second channel, such as email, while they still have access. Otherwise your support restores access.
Do I still need my own user accounts?
Yes. Sendity delivers the verified contact; your app manages accounts and sessions. The Laravel package takes care of most of that.
Keep reading.
Reviewed for accuracy in by Christian Schätzlein.
Accounts with one message, no password.
Try the live demo on your phone. It takes ten seconds.