> passwordless login is a single-factor authentication and less secure than MFA If you go from MFA to fido2, maybe. If you go from single-factor password, to s

> passwordless login is a single-factor authentication and less secure than MFA If you go from MFA to fido2, maybe. If you go from single-factor password, to single-factor fido2 - it's likely security will improve. A lot. > Depending on whenever hardware key is more or less secure than the password It is: A password can be sniffed, filmed, inferred from sound recording. You don't know when someone knows your password; a key will be missing (or copied, but that's supposed to be Very Difficult (tm)). A password is unlikely to encode as much entropy; certainly any password/phrase you actually type in. 128+ bits of entropy is surprisingly hard to encode in a manageable size (it's 16 completely random binary bytes). Now, if the assumption is that the alternative is a ssh key locked on a device, additionally protected by a pin... Maybe The fido2 is slightly less secure. But if you try and list the failure modes / do some threat modelling ; I think you'll see it ends up a close race. It would certainly pair well with "something you know" - eg a pin/password with somehow proper rate-limiting.