On this page
Where sign-up loses people
The password field is where sign-up flows leak. You are asking somebody who has not yet decided they want your product to invent a secret, satisfy your complexity rules, and find somewhere to keep it.
Plenty of teams route around this with an emailed code at every login. That trades one friction for a slower one, because the user now waits on an inbox every single visit, and the code itself is phishable.
The password step costs completions
It is an extra decision at the point where intent is weakest. Users who abandon there never see the product you spent the year building.
Whatever they pick is probably reused
A new account usually gets an old password, so it starts life exposed to somebody else's breach before it has been used once.
A code at every login is not the fix
Per-login email OTP removes the memory problem and adds a wait. SenseCrypt uses a one-time PIN once, and only to bind a new device, never at sign-in.
Enrollment from a photo you already hold
If you already have a photo of the user, most of the enrollment work is done. SenseCrypt builds the enrollment from that photo, and the first sign-in is a face login on the user's own device.
Nothing is chosen, nothing is remembered, and nothing is handed over at any point in the flow.
The first sign-in is the whole ceremony
No separate registration step, no set-your-password email, no waiting on an activation link. The user opens the app and looks at the camera.
The match runs on the device
Capture and comparison happen on the user's phone or laptop. The server keeps no face image and no face template, so a fast onboarding flow does not leave you holding biometric material.
One single-use token per sign-in
The patent-pending tokenization means each ceremony produces one token and spends it. There is nothing durable in transit from the very first login.
What you get
The funnel gets shorter by exactly one step, which sounds trivial until you compare it with the abandonment rate on that step.
The security position is also better on day one instead of after a migration project, because the first account you create has no password attached and every sign-in is device-bound from the start.
One less field, one less place to drop out
Removing the password step removes the decision that most often ends a sign-up before it finishes.
Phishing-resistant from account one
You are not planning a future project to move users off passwords, because they never had one to move off.
Ordinary standards integration
OIDC and OAuth 2.0 with PKCE and PAR carry the sign-up and sign-in flow, and SCIM 2.0 handles accounts that arrive from another system.
Who it fits
This suits teams whose sign-up sits at the top of a funnel they measure, and who already hold a photo of the user or can reasonably ask for one. Developers wire it up with the same OIDC or OAuth 2.0 code they would write for any provider.
One dollar per user per month with a 20-seat minimum. Customer identity bills as monthly active users, so a signed-up account that goes quiet costs you nothing that month, and the 30-day trial takes no card.
- Customer identity (CIAM) teams.
- B2B SaaS teams that onboard tenants.
- Developers who use OIDC and OAuth 2.0.
Frequently asked questions
What is passwordless onboarding?
It is sign-up without a password. A user enrolls from a photo on file, then signs in by face.
Does a user set a password at sign-up?
No. The first sign-in is a face login. There is no password to set. SenseCrypt uses an emailed one-time PIN only to bind the new device, and also sends it by SMS when the user's profile includes a mobile number.
How do developers add SenseCrypt to sign-up?
They use standard OIDC and OAuth 2.0 with PKCE and PAR. SenseCrypt is a full identity provider (IdP).
Is onboarding by face phishing-resistant?
Yes. The first sign-in binds to the device. A user enters no password and no shared code.
Related