Take the password out of apps built around one.
Passwordless projects usually stop at apps that support SSO. The rest, often the most sensitive, keep their passwords. Bastyx is designed to give each of them a passwordless sign-in, using whichever path the app can support, with no rewrites.
Concept UI with sample data. The product is in development and details will change.
Why legacy apps keep their passwords
The finance system, the network gear, the vendor console and the internal tool someone built in 2014 all have one thing in common: a login form, and no way to plug in modern authentication.
- No SSO support. The app predates SAML and OpenID Connect, or the vendor charges extra for them.
- Shared accounts. One admin login for the whole team, kept in a password manager or a spreadsheet.
- Phishable by design. A password a person types is a password a look-alike page, or an AI-written message, can ask for.
- Missed at offboarding. Disabling someone’s SSO account doesn’t change the passwords they knew.
These are often the systems that matter most. Password elimination for legacy apps means taking the password out of people’s hands, even where the app can’t let go of it.
Four ways to zero passwords
Each app gets the strongest path it can support. In every case, people sign in with a passkey or security key, and nobody knows a password for the app.
- Planned
Single sign-on
For: Apps that support SAML or OpenID Connect
Bastyx verifies the person with FIDO2 and sends the app a signed SAML assertion or OIDC token. Once everyone signs in this way, you switch off the app’s local password login.
- App changes:
- Configuration only
- What’s left:
- Nothing. Local login is switched off.
- Planned
Access proxy
For: Internal web apps with no SSO support
An identity-aware proxy sits in front of the app, on-premises or in your cloud. People authenticate at the proxy with FIDO2, and the app receives the verified identity in a trusted header. The app is no longer reachable directly.
- App changes:
- Route traffic through the proxy. None for apps that accept a trusted identity header.
- What’s left:
- Nothing for people to know. The app is only reachable through the proxy.
- Planned
Vaulted credentials
For: Apps that only accept a username and password
For apps that can’t change at all, Bastyx keeps a long random password that no person ever sees. After a FIDO2 check, it’s filled in for the person, and it’s rotated automatically. Shared admin logins become named, recorded sign-ins.
- App changes:
- None. The app keeps its login form.
- What’s left:
- A random password nobody knows, rotated automatically.
- Exploring
Directory sign-in
For: Apps that use Active Directory and Kerberos
Passwordless Windows sign-in gets the person a Kerberos ticket without a typed password, so apps that use Integrated Windows Authentication open without a prompt.
- App changes:
- None
- What’s left:
- A directory password that’s randomized and never typed.
Which path fits which app
- SaaS and modern apps with SAML or OpenID Connect
- Single sign-on
- Internal web tools, dashboards and admin panels
- Access proxy
- Vendor consoles, appliances and shared admin logins
- Vaulted credentials
- Windows apps that use Integrated Windows Authentication
- Directory sign-in
- Apps that only run on your internal network
- Any path, with on-premises deployment
Zero login prompts
The goal is that people sign in once, with a fingerprint or a key, and legacy apps open without asking for a password.
Unlock the laptop
A fingerprint on the built-in sensor, or a touch of the security key. No password.
Open the finance ERP
It opens signed in. The access proxy already knows who you are.
Open the network admin console
It asks for a key touch, because policy says it’s sensitive. The password is filled in for you, and you never see it.
Leave the company
One offboarding action removes access to every app. Nobody knew the vaulted passwords, so there’s nothing to rotate.
Roll it out app by app
No big-bang migration. Each app moves on its own schedule, and nothing breaks for people who haven’t moved yet.
- 1
Inventory your apps
List every app and how it signs people in today. Start with the ones where passwords are shared.
- 2
Pick a path per app
Use the table above. Most apps fit one path; some start on a vaulted credential and move to SSO later.
- 3
Enroll people first
Everyone registers a passkey or security key before any app changes.
- 4
Switch one app over
The pilot group uses the new path while the old login keeps working as a fallback.
- 5
Remove the password
Switch off local login, or let Bastyx rotate the password into the vault so no one knows it.
- 6
Let offboarding cover it
From then on, revoking a person removes their access to every legacy app in the same action.
Legacy app questions
Do we have to change application code?
No. Single sign-on is configuration, the access proxy works in front of the app, and vaulted credentials use the login form the app already has. The design goal is that no path requires a rewrite.
Is a vaulted credential really passwordless?
For people, yes. The app still has a password, but it’s long, random, rotated automatically and never shown to anyone. People sign in with a passkey or security key, so there’s nothing they can be phished for, reuse elsewhere or take with them when they leave.
What about apps that only run on our internal network?
The access proxy and the credential vault are designed to run next to the apps they protect. With the planned on-premises deployment, the control plane runs in your environment too.
What happens to shared admin accounts?
They become named sign-ins. Each person verifies with FIDO2, Bastyx fills in the shared credential, and the event log records who used it and when. The password rotates, so nobody walks away knowing it.
What about desktop (thick-client) apps?
Vaulted credentials are the likely path. We’re still working out how filling credentials into desktop clients should work, and we’ll document which clients are supported before this reaches early-access teams.
Can we keep the old password during rollout?
Yes. Each app switches over on its own schedule, and the old login can stay as a fallback for the pilot group until you remove it.
Which of your apps still run on passwords?
Tell us about them. Early-access teams will shape which paths ship first.