Technology
How WWPass works
How usernameless passwordless authentication works in WWPass: the user requests access to a service, the service provider communicates with WWPass and provides its unique Service Provider key (SPID), then asks the user to provide their WWPass Key (UserID) to WWPass. WWPass uses both keys together to open the corresponding encrypted data container and passes the contents to the service provider. No username entered. No password transmitted. No credentials stored anywhere in the process.
Technology
How WWPass works
How usernameless passwordless authentication works in WWPass: the user requests access to a service, the service provider communicates with WWPass and provides its unique Service Provider key (SPID), then asks the user to provide their WWPass Key (UserID) to WWPass. WWPass uses both keys together to open the corresponding encrypted data container and passes the contents to the service provider. No username entered. No password transmitted. No credentials stored anywhere in the process.
Technology
How WWPass works
How usernameless passwordless authentication works in WWPass: the user requests access to a service, the service provider communicates with WWPass and provides its unique Service Provider key (SPID), then asks the user to provide their WWPass Key (UserID) to WWPass. WWPass uses both keys together to open the corresponding encrypted data container and passes the contents to the service provider. No username entered. No password transmitted. No credentials stored anywhere in the process.
Three parties, zero credentials
Every WWPass authentication involves three parties.
1. The User authenticates using a WWPass Key
Dual interface USB/NFC token, or a smartcard, or the WWPass Key mobile app on iOS or Android. No username is entered at any point.
2. The Service Provider is any application that requires authentication
Web portal, corporate system, VPN, cloud service, or remote desktop. The service provider holds a unique Service Provider Identifier (SPID).
3. The WWPass Core Network acts as a third-party identity provider
It verifies the authentication without ever seeing the user's data and stores nothing that could identify the user to any other service.`
Three parties, zero credentials
Every WWPass authentication involves three parties.
1. The User authenticates using a WWPass Key
Dual interface USB/NFC token, or a smartcard, or the WWPass Key mobile app on iOS or Android. No username is entered at any point.
2. The Service Provider is any application that requires authentication
Web portal, corporate system, VPN, cloud service, or remote desktop. The service provider holds a unique Service Provider Identifier (SPID).
3. The WWPass Core Network acts as a third-party identity provider
It verifies the authentication without ever seeing the user's data and stores nothing that could identify the user to any other service.`
Three parties, zero credentials
Every WWPass authentication involves three parties.
1. The User authenticates using a WWPass Key
Dual interface USB/NFC token, or a smartcard, or the WWPass Key mobile app on iOS or Android. No username is entered at any point.
2. The Service Provider is any application that requires authentication
Web portal, corporate system, VPN, cloud service, or remote desktop. The service provider holds a unique Service Provider Identifier (SPID).
3. The WWPass Core Network acts as a third-party identity provider
It verifies the authentication without ever seeing the user's data and stores nothing that could identify the user to any other service.`
Zero-trust authentication explained
Zero-trust authentication verifies identity without the user ever sending a credential. All cryptographic operations run on the user's device. WWPass receives a one-time proof tied to a single session, verifies it against distributed encrypted data, and grants access. Nothing reusable is transmitted.
Zero-trust authentication explained
Zero-trust authentication verifies identity without the user ever sending a credential. All cryptographic operations run on the user's device. WWPass receives a one-time proof tied to a single session, verifies it against distributed encrypted data, and grants access. Nothing reusable is transmitted.
Zero-trust authentication explained
Zero-trust authentication verifies identity without the user ever sending a credential. All cryptographic operations run on the user's device. WWPass receives a one-time proof tied to a single session, verifies it against distributed encrypted data, and grants access. Nothing reusable is transmitted.
How it works
For users, secure access is as simple as scanning a QR code with the WWPass Key App. Behind the scenes, WWPass performs complex cryptographic authentication.
User experience
Technical overview
1. User scans QR
Using the WWPass Key App, the user scans the QR code shown on your service's login screen.
2. Authentication
WWPass authenticates the key and provider, then locates the matching data container.
3. Access granted
The service provider verifies the user and grants access, with identity hidden from attackers.
How it works
For users, secure access is as simple as scanning a QR code with the WWPass Key App. Behind the scenes, WWPass performs complex cryptographic authentication.
User experience
Technical overview
1. User scans QR
Using the WWPass Key App, the user scans the QR code shown on your service's login screen.
2. Authentication
WWPass authenticates the key and provider, then locates the matching data container.
3. Access granted
The service provider verifies the user and grants access, with identity hidden from attackers.
How it works
For users, secure access is as simple as scanning a QR code with the WWPass Key App. Behind the scenes, WWPass performs complex cryptographic authentication.
User experience
Technical overview
1. User scans QR
Using the WWPass Key App, the user scans the QR code shown on your service's login screen.
2. Authentication
WWPass authenticates the key and provider, then locates the matching data container.
3. Access granted
The service provider verifies the user and grants access, with identity hidden from attackers.
Every service sees a different you
For each combination of UserID and SPID, WWPass generates a unique Protected User Identifier (PUID). This is an opaque, randomly generated string specific to that user's relationship with that specific service.
The PUID for a user's banking portal is entirely different from their PUID for a healthcare system or corporate VPN. The identifiers cannot be correlated across services. A breach at one service provider exposes nothing about the same user's activity elsewhere.
WWPass generates the container identifier using a one-way permutation function applied to the UserID and SPID combination. It is mathematically impossible to reverse this transformation and recover the original identifiers.
No usernames. No email addresses. No shared identity across services.
Every service sees a different you
For each combination of UserID and SPID, WWPass generates a unique Protected User Identifier (PUID). This is an opaque, randomly generated string specific to that user's relationship with that specific service.
The PUID for a user's banking portal is entirely different from their PUID for a healthcare system or corporate VPN. The identifiers cannot be correlated across services. A breach at one service provider exposes nothing about the same user's activity elsewhere.
WWPass generates the container identifier using a one-way permutation function applied to the UserID and SPID combination. It is mathematically impossible to reverse this transformation and recover the original identifiers.
No usernames. No email addresses. No shared identity across services.
Every service sees a different you
For each combination of UserID and SPID, WWPass generates a unique Protected User Identifier (PUID). This is an opaque, randomly generated string specific to that user's relationship with that specific service.
The PUID for a user's banking portal is entirely different from their PUID for a healthcare system or corporate VPN. The identifiers cannot be correlated across services. A breach at one service provider exposes nothing about the same user's activity elsewhere.
WWPass generates the container identifier using a one-way permutation function applied to the UserID and SPID combination. It is mathematically impossible to reverse this transformation and recover the original identifiers.
No usernames. No email addresses. No shared identity across services.
Multiple nodes. No single point of failure. Zero knowledge.
WWPass stores no data in traditional database tables. Instead, data is kept in isolated containers, encrypted, and distributed across multiple certified geographically dispersed storage nodes. No single node stores enough data to reconstruct a user's information. A compromised node yields nothing usable.
Service Provider Front Ends (SPFEs)
Handle communication between service providers and WWPass storage.
Storage Nodes
Geographically distributed servers holding encrypted data fragments.
User Front Ends ∙ UserFEs
Handle user authentication and PIN verification.
Data Miners. Distribution
Disperse data containers across storage nodes on write.
Multiple front ends and data miners run concurrently
There is no single point of failure in the architecture.
Data Miners. Reconstruction
Reassemble data containers on read, maintaining integrity using error detection and correction.
Multiple nodes. No single point of failure. Zero knowledge.
WWPass stores no data in traditional database tables. Instead, data is kept in isolated containers, encrypted, and distributed across multiple certified geographically dispersed storage nodes. No single node stores enough data to reconstruct a user's information. A compromised node yields nothing usable.
Service Provider Front Ends (SPFEs)
Handle communication between service providers and WWPass storage.
Storage Nodes
Geographically distributed servers holding encrypted data fragments.
User Front Ends ∙ UserFEs
Handle user authentication and PIN verification.
Data Miners. Distribution
Disperse data containers across storage nodes on write.
Multiple front ends and data miners run concurrently
There is no single point of failure in the architecture.
Data Miners. Reconstruction
Reassemble data containers on read, maintaining integrity using error detection and correction.
Multiple nodes. No single point of failure. Zero knowledge.
WWPass stores no data in traditional database tables. Instead, data is kept in isolated containers, encrypted, and distributed across multiple certified geographically dispersed storage nodes. No single node stores enough data to reconstruct a user's information. A compromised node yields nothing usable.
Service Provider Front Ends (SPFEs)
Handle communication between service providers and WWPass storage.
Storage Nodes
Geographically distributed servers holding encrypted data fragments.
User Front Ends ∙ UserFEs
Handle user authentication and PIN verification.
Data Miners. Distribution
Disperse data containers across storage nodes on write.
Multiple front ends and data miners run concurrently
There is no single point of failure in the architecture.
Data Miners. Reconstruction
Reassemble data containers on read, maintaining integrity using error detection and correction.
WWPass cannot see your data — by design
Zero trust is a foundational principle of the WWPass architecture, not a marketing claim. By design, all users are anonymous to WWPass.
User data arrives from the service provider in encrypted form, with encryption keys unknown to WWPass. It returns to the service provider intact. WWPass never decrypts it, never reads it, and cannot access it.
Data containers are ciphered using a key derived from a one-way permutation of the SPID and UserID combination. Only the simultaneous presence of both identifiers, combined with the correct cryptographic transformation, enables the container to be accessed.
This design eliminates insider threat risk by default. A WWPass employee with full system access cannot extract user data. There is no backdoor because there is no technical path to one.
WWPass cannot see your data — by design
Zero trust is a foundational principle of the WWPass architecture, not a marketing claim. By design, all users are anonymous to WWPass.
User data arrives from the service provider in encrypted form, with encryption keys unknown to WWPass. It returns to the service provider intact. WWPass never decrypts it, never reads it, and cannot access it.
Data containers are ciphered using a key derived from a one-way permutation of the SPID and UserID combination. Only the simultaneous presence of both identifiers, combined with the correct cryptographic transformation, enables the container to be accessed.
This design eliminates insider threat risk by default. A WWPass employee with full system access cannot extract user data. There is no backdoor because there is no technical path to one.
WWPass cannot see your data — by design
Zero trust is a foundational principle of the WWPass architecture, not a marketing claim. By design, all users are anonymous to WWPass.
User data arrives from the service provider in encrypted form, with encryption keys unknown to WWPass. It returns to the service provider intact. WWPass never decrypts it, never reads it, and cannot access it.
Data containers are ciphered using a key derived from a one-way permutation of the SPID and UserID combination. Only the simultaneous presence of both identifiers, combined with the correct cryptographic transformation, enables the container to be accessed.
This design eliminates insider threat risk by default. A WWPass employee with full system access cannot extract user data. There is no backdoor because there is no technical path to one.
App, token, or both
WWPass authentication requires a WWPass Key. It is available in two forms. One WWPass Key works across all services. A lost key can be revoked using the Service Key, issued alongside the primary key for key management purposes only
App
Enables secure day-to-day logins directly from a mobile device, providing convenient access to protected services.
Hardware token
Provides PKI-based authentication for computers, remote desktops, and VPNs.
App, token, or both
WWPass authentication requires a WWPass Key. It is available in two forms. One WWPass Key works across all services. A lost key can be revoked using the Service Key, issued alongside the primary key for key management purposes only
App
Enables secure day-to-day logins directly from a mobile device, providing convenient access to protected services.
Hardware token
Provides PKI-based authentication for computers, remote desktops, and VPNs.
App, token, or both
WWPass authentication requires a WWPass Key. It is available in two forms. One WWPass Key works across all services. A lost key can be revoked using the Service Key, issued alongside the primary key for key management purposes only
App
Enables secure day-to-day logins directly from a mobile device, providing convenient access to protected services.
Hardware token
Provides PKI-based authentication for computers, remote desktops, and VPNs.
Integrations
WWPass works alongside your existing identity infrastructure, integrating with Microsoft Entra ID, Okta, Auth0, Salesforce, AWS, IBM Security Access Manager, Cisco, and Fortinet through standard IAM and SSO protocols. No rip and replace required. Support includes encrypted cloud storage, PKI email and Winlogon, disk encryption, VPN, and remote desktop logins.
Identity & Security Platforms
Microsoft environments
WWPass supports the OIDC protocol required for an External Authentication Method with Entra ID. The existing directory and user objects stay in place.
Protocols
SAML, OAuth2 / OIDC, LDAP, RADIUS, and Kerberos
Integrations
WWPass works alongside your existing identity infrastructure, integrating with Microsoft Entra ID, Okta, Auth0, Salesforce, AWS, IBM Security Access Manager, Cisco, and Fortinet through standard IAM and SSO protocols. No rip and replace required. Support includes encrypted cloud storage, PKI email and Winlogon, disk encryption, VPN, and remote desktop logins.
Identity & Security Platforms
Microsoft environments
WWPass supports the OIDC protocol required for an External Authentication Method with Entra ID. The existing directory and user objects stay in place.
Protocols
SAML, OAuth2 / OIDC, LDAP, RADIUS, and Kerberos
Integrations
WWPass works alongside your existing identity infrastructure, integrating with Microsoft Entra ID, Okta, Auth0, Salesforce, AWS, IBM Security Access Manager, Cisco, and Fortinet through standard IAM and SSO protocols. No rip and replace required. Support includes encrypted cloud storage, PKI email and Winlogon, disk encryption, VPN, and remote desktop logins.
Identity & Security Platforms
Microsoft environments
WWPass supports the OIDC protocol required for an External Authentication Method with Entra ID. The existing directory and user objects stay in place.
Protocols
SAML, OAuth2 / OIDC, LDAP, RADIUS, and Kerberos
Common questions
Learn more about WWPass and contact us to discuss your use case and get a demo.
How is WWPass different from passkeys?
What happens if a user loses their WWPass Key?
Does the service provider ever see the user's identity?
What protocols does WWPass support?
Can WWPass be used without a PIN?
Common questions
Learn more about WWPass and contact us to discuss your use case and get a demo.
How is WWPass different from passkeys?
What happens if a user loses their WWPass Key?
Does the service provider ever see the user's identity?
What protocols does WWPass support?
Can WWPass be used without a PIN?
Common questions
Learn more about WWPass and contact us to discuss your use case and get a demo.
How is WWPass different from passkeys?
What happens if a user loses their WWPass Key?
Does the service provider ever see the user's identity?
What protocols does WWPass support?
Can WWPass be used without a PIN?
Get WWPass
Download the WWPass Key app and test authentication without a username or password.
Get WWPass
Download the WWPass Key app and test authentication without a username or password.
