Passwordless sign-in on Windows 10 and 11 lets you log into your PC using a PIN, fingerprint, face recognition, or a physical security key, without ever typing a traditional password. Microsoft has been pushing this feature hard, and in 2026, it’s more reliable and accessible than ever.
Passwordless Sign-in in Windows
When you sign into Windows with a Microsoft account, your account is tied to a password stored on Microsoft’s servers. Passwordless sign-in removes that password from the equation on your local device. Instead, you authenticate using something you have (like your phone or a security key) or something you are (like your face or fingerprint).
Microsoft calls their main implementation Windows Hello, and the underlying standard behind it is called FIDO2, which is an open authentication protocol supported across platforms and browsers.
There are two slightly different things people mean when they say “passwordless sign-in”:
- Windows Hello (PIN, fingerprint, face ID) replaces your password at the lock screen
- Passwordless Microsoft Account actually removes the password from your Microsoft account entirely
Both are covered below.
Should You Enable It?
| Scenario | Recommendation |
|---|---|
| Personal laptop at home | Enable it, easier and faster |
| Shared family PC | Enable per-user, PIN is the safest bet |
| Work PC on domain | Check IT policy first |
| Older device, no fingerprint sensor | PIN still works great |
| You forget PINs easily | Stick with password or use a password manager |
Passwordless is genuinely more secure than most passwords people actually use. A PIN stored locally on the device is not sent over the network, which means if Microsoft’s servers are breached, your local sign-in is unaffected.
Method 1: Enable Passwordless Sign-in Using Windows Hello
This is the most common route and works on both Windows 10 and Windows 11.
On Windows 11
- Open Settings (Win + I)
- Go to Accounts
- Click Sign-in options
- Under Ways to sign in, you’ll see options for Facial recognition (Windows Hello), Fingerprint recognition (Windows Hello), and PIN (Windows Hello)
- Click the one you want, then click Set up
- Follow the on-screen prompts. For PIN, you create a numeric or alphanumeric PIN. For face/fingerprint, your hardware needs to support it
Once set up, Windows will use that method by default at the lock screen.
On Windows 10
- Open Settings
- Go to Accounts > Sign-in options
- You’ll see Windows Hello Face, Windows Hello Fingerprint, and Windows Hello PIN listed separately
- Click Set up under whichever option you want
- You may be asked to verify your Microsoft account password first during setup
After this, your password is no longer needed at sign-in.
Method 2: Remove Your Microsoft Account Password Entirely
This goes one step further. Instead of just bypassing the password at sign-in, you remove the password from your Microsoft account altogether.
Microsoft started offering this in 2021 and has continued expanding it. When your account is passwordless, you sign in to Microsoft services (Outlook, Xbox, Teams) using the Authenticator app, email code, or Windows Hello.
Steps to Go Fully Passwordless
- Go to account.microsoft.com/security in your browser
- Sign in with your Microsoft account
- Click Advanced security options
- Scroll to Passwordless account
- Click Turn on
- Microsoft will send a prompt to the Microsoft Authenticator app on your phone
- Approve the request on your phone
- Confirm on the website
After this, your Microsoft account has no password. Sign-ins happen through the Authenticator app or Windows Hello.
Important: You need the Microsoft Authenticator app installed on your phone before doing this. Download it from your phone’s app store.
Method 3: Enable Passwordless Sign-in via Local Account (No Microsoft Account)
If you use a local Windows account instead of a Microsoft account, Windows Hello PIN still works. You won’t get the “remove password from Microsoft account” option since there’s no Microsoft account involved, but you can still sign in without typing a password by setting up a PIN.
- Go to Settings > Accounts > Sign-in options
- Click PIN (Windows Hello)
- Click Set up
- Enter your current Windows account password when prompted
- Create your PIN
From this point on, you sign in with your PIN instead of your password.
Method 4: Use a Physical Security Key (FIDO2)
For users who want the highest security level, a physical hardware key like a YubiKey works with Windows Hello for Business and personal Microsoft accounts.
- Plug in your FIDO2 security key (USB or NFC)
- Go to Settings > Accounts > Sign-in options
- Scroll to Security key
- Click Manage
- Follow the setup instructions to register the key
You’ll need to tap the key physically to sign in. This method is excellent for high-security scenarios, and it’s fully phishing-resistant since the key only responds to the real sign-in prompt.
How to Disable Passwordless Sign-in in Windows 11/10
Maybe you set it up and now want to revert. Here’s how to turn it off depending on what you enabled.
Disable Windows Hello PIN
- Go to Settings > Accounts > Sign-in options
- Click PIN (Windows Hello)
- Click Remove
- You’ll be asked to confirm with your Microsoft account password
- Click Remove again
Your PIN is now deleted. You’ll sign in with your password again.
Disable Windows Hello Face or Fingerprint
- Go to Settings > Accounts > Sign-in options
- Click Facial recognition or Fingerprint recognition
- Click Remove
This removes the biometric data from the device.
Re-enable Your Microsoft Account Password
If you went fully passwordless and want your password back:
- Go to account.microsoft.com/security
- Click Advanced security options
- Under Passwordless account, click Turn off
- Follow the prompts to create a new password
Microsoft will guide you through setting a new password for your account.
Managing Passwordless Sign-in via Group Policy (For IT Admins)
If you’re managing multiple Windows machines, Group Policy gives you centralized control.
- Open Group Policy Editor (
gpedit.msc) - Navigate to: Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business
- Here you can:
- Enable or disable Windows Hello for Business
- Require specific authentication methods
- Block PIN use or require biometrics
For enterprise environments, Microsoft Intune and Azure Active Directory also provide policies to enforce or restrict passwordless sign-in across a fleet of devices. Microsoft’s documentation on Windows Hello for Business deployment covers this in detail.
Passwordless Sign-in Options: Quick Comparison
| Method | Security Level | Works Without Internet | Requires Hardware |
|---|---|---|---|
| PIN | High | Yes | No |
| Fingerprint | Very High | Yes | Fingerprint sensor |
| Face ID | Very High | Yes | IR camera |
| Security Key (FIDO2) | Highest | Yes | Security key device |
| Authenticator App | High | No (needs phone) | Smartphone |
Common Issues and Fixes
PIN setup fails with error “Something went wrong” This usually happens if your Microsoft account session has expired. Sign out and sign back into your Microsoft account in Settings, then try again.
Windows Hello option is greyed out Your device may not meet the hardware requirements. Windows Hello for biometrics needs a compatible camera or fingerprint sensor. PIN should still be available on all devices.
Face recognition stopped working after a Windows update Go to Sign-in options, remove the face sign-in data, and re-enroll. Updates occasionally reset the biometric data.
Can’t remove PIN because it asks for a password I don’t remember If you’ve forgotten your Microsoft account password, reset it at account.live.com/password/reset first. Then come back and remove the PIN.
Passwordless account option not showing in Microsoft account settings This feature is available for personal Microsoft accounts but may not appear for school or work accounts managed by an organization.
Conclusion
Passwordless sign-in in Windows 10 and 11 is not just a gimmick. It’s faster than typing a password, more resistant to phishing and credential theft, and surprisingly easy to set up. A PIN takes about two minutes to configure and immediately makes your day-to-day login smoother.
If you want to go further, removing your Microsoft account password entirely and relying on the Authenticator app or Windows Hello is a solid security upgrade. And if you ever want to go back, the steps to disable everything and restore a traditional password are just as simple.
Frequently Asked Questions
If I set up a PIN, does my Microsoft account password get deleted?
No. Setting up a Windows Hello PIN does not touch your Microsoft account password. The PIN is a local credential stored only on that specific device. Your Microsoft account password still exists and can still be used to sign in on other devices or reset access. Only the “Passwordless account” option in your Microsoft account settings actually removes the password.
Can I use passwordless sign-in on a PC that’s joined to a work domain?
It depends on your organization’s IT policies. Windows Hello for Business is designed for enterprise environments, but your IT department may have specific requirements or restrictions. Some organizations block biometric sign-in entirely, while others require it. Check with your IT team before making changes on a work-managed device.
What happens if I forget my PIN?
At the sign-in screen, click I forgot my PIN. Windows will ask you to verify your identity using your Microsoft account credentials (password or Authenticator app), then let you set a new PIN. You won’t lose any data or files on your PC from resetting a PIN.
Does passwordless sign-in work with multiple user accounts on the same PC?
Yes. Each user account on the device has its own separate sign-in settings. One user can use a PIN, another can use fingerprint, and a third can stick with a traditional password. The setup in Settings > Accounts > Sign-in options only applies to the account you’re currently signed into.
Is a PIN safer than a strong password?
In most practical scenarios, yes. A PIN is stored locally on the device and protected by the Trusted Platform Module (TPM) chip. It never leaves your PC and is never transmitted over the network. Even if someone knows your PIN, they can’t use it without physical access to your specific device. A password, by contrast, can be stolen through phishing, database breaches, or keyloggers from anywhere in the world.
