Why We Killed Passwords for Job Candidates and What Replaced Them

More than half of candidates who start a job application never finish it. According to a LiveCareer study, 57% abandon specifically because of complex processes and lack of transparency. Creating an account and setting a password can add to that complexity. We removed passwords entirely from Kit’s candidate experience, replacing them with magic links. This article explains why, with the data that made the decision obvious.

The password tax on hiring

Every ATS that forces candidates to “Create an Account” before applying is running a conversion experiment. The result of that experiment has been consistent for over a decade: you lose most of your applicants at the login screen.

When applications take more than 15 minutes (which happens quickly once you add email verification, password rules, and failed resume parsing), completion rates drop from 12.5% to 3.6%, according to Appcast’s 2026 Recruitment Marketing Benchmark Report.

Think about what that means in dollars. You spent money on job board postings, employer branding, maybe even programmatic ads. You got a candidate interested enough to click “Apply.” Then your ATS asked them to invent a 12-character password with a special symbol for a system they will use exactly three times. They closed the tab.

Reducing application time to five minutes or less boosts conversion rates by up to 365%, according to Appcast. That is not a marginal improvement. That is the difference between hiring someone and not.

What candidates actually experience

If you have not applied for a job through Workday recently, try it. The experience is clarifying.

The legacy wall: Workday, Taleo, iCIMS

Workday requires a brand-new account for every company. There is no centralized candidate identity. Candidates on Reddit’s r/recruitinghell routinely describe the experience as turning a one-minute task into a ten-minute ordeal. Others say they skip any job listing that routes to a Workday login page.

Oracle Taleo is worse. The multi-page workflows, rigid password requirements, and frequent session timeouts are so hostile that candidates report closing the browser the instant they see “taleo” in the URL. Industry analysts have noted the product “pretty much fails at everything” regarding user experience.

iCIMS asks you to upload a resume, then immediately re-type the same information into separate form fields. Their own 2025 State of Frontline Hiring Report acknowledges a 68% application abandonment rate in hospitality alone.

The better middle: Greenhouse, Lever, Ashby

Modern platforms recognized this problem. Greenhouse lets you apply without an account, though its optional “MyGreenhouse” portal still uses passwords. Lever relies on Google/LinkedIn SSO, which candidates generally prefer. Ashby goes further with a native “Sign in with a Magic Link” option.

The trajectory is clear. The market is moving away from passwords. The only question is how fast.

Why mobile makes passwords unacceptable

Over 65% of job applications now start on mobile devices, according to Appcast. In hospitality and gig economy roles, that number exceeds 80%.

Typing a complex password on a phone keyboard is slow and error-prone. Switching to a mail app for a verification code often kills the session. Returning to the browser means starting over. These are not edge cases; they are the default experience for most applicants.

This means organizations with password-gated portals are systematically filtering out mobile-first candidates. That includes most Gen Z professionals, frontline workers, and passive candidates scrolling LinkedIn on their phone. You are not just losing applications. You are losing an entire demographic.

How magic links work

A magic link replaces the password with something the candidate already controls: their email inbox.

1. Candidate enters their email address. One field. No “choose a username” or “confirm your password.”
2. The system generates a cryptographic token. This is a signed token tied to the candidate’s profile. In Kit it expires after seven days.
3. The token arrives as a clickable link. The emailed link opens the portal after token validation.
4. One click, they are in. In Kit, the current link remains reusable until it expires or a new link is sent. It is not single-use.

The key insight is access frequency. Passwords were designed for systems you use daily: your email, your bank, your work laptop. A candidate interacts with an ATS maybe three times over a 45-day hiring cycle: once to apply, once to schedule an interview, once to review an offer.

Asking someone to create and remember a password for three lifetime logins is an anti-pattern. By the time they return two weeks later for an interview, they have forgotten it. They click “Forgot password.” The reset flow sends an email with a one-time link. That is literally a magic link with five extra steps of frustration.

Magic links just make the recovery path the primary path.

Security without the theater

The most common pushback we hear from enterprise buyers is security. “Don’t you need a password to be secure?” Security depends on the full authentication design, including protection of the email inbox.

Passwords are the vulnerability

85% of consumers reuse passwords across platforms, with 41% doing so frequently, according to LastPass’s Psychology of Passwords report. When candidates use the same password for your ATS portal and a compromised hobby forum, your candidate data is exposed through credential stuffing attacks. This is not theoretical. It happens constantly.

Magic links vs. passkeys

In 2026, the two main passwordless options are magic links and passkeys (FIDO/WebAuthn). Passkeys use public key cryptography stored on the user’s device, protected by local device unlocking such as biometrics or a PIN. They are cryptographically stronger and ideal for high-frequency access.

Authentication choices must account for the data behind the portal. This includes offers, correspondence and recruiting-stage information, not only resumes and contact details. Intercepting a link or compromising an inbox can expose that data. Email links do not provide passkeys’ phishing resistance; NIST describes limitations of email authentication.

In Kit, a candidate-portal link expires after seven days. It can be reused before expiry, and sending a new link invalidates earlier links. This makes returning to the process convenient, but the link remains an access credential and should not be shared.

Password reset costs add up

Password resets account for 20-50% of all IT help desk tickets, according to Gartner. Each reset costs roughly $70 in labor, per Forrester estimates. For recruiting teams, this translates to talent acquisition professionals troubleshooting login issues instead of sourcing candidates.

The measurable impact of going passwordless

Conversion lifts

Appcast’s data shows that reducing friction in the application process (fewer fields, fewer steps, no account creation) yields the largest gains on mobile, where form completion rates are lowest. Their benchmark data consistently shows that mobile-optimized, low-friction applications convert 2-3x better than traditional multi-step flows.

The pattern holds across industries: remove barriers, and completion rates rise. The largest gains come from mobile users, who face the most friction from password entry.

Re-engagement transforms

Here is a number that should change how you think about your talent pool. Slack shared publicly that teams using magic link invitations completed onboarding 2.3 days faster than those with traditional password flows, correlating with 31% higher annual contract values. Video platform Money Alive reported a 75% reduction in support time after switching from passwords to temporary access codes.

These are not recruiting-specific examples, and their results cannot be transferred directly to recruiting. Low-frequency, high-intent access is exactly the profile of a job candidate. When you send a returning candidate a magic link instead of asking them to remember a password from six months ago, more of them actually click through.

How Kit handles passwordless candidate access

When we built Kit, we made a deliberate architectural decision: candidates never see a registration form, a password field, or an account creation screen. Whether they are applying for a role, picking an interview time, submitting a code assignment, or reviewing an offer letter, the flow is the same.

They enter their email. They click the link. They are in.

This is not a feature. It is a philosophy. If you believe that candidates are people you are trying to attract, not suppliants who should be grateful for the chance to apply, then every interaction should respect their time. Passwords do the opposite.

What this enables downstream

Removing friction at the top of the funnel has compounding effects. When it is effortless to enter the process, more qualified candidates complete their applications. That means your pipeline has better signal. Better signal means your team spends less time screening and more time interviewing people who actually fit.

The same magic link architecture powers every candidate touchpoint in Kit. Interview scheduling, code assignments, offer reviews, and status checks all use the same one-click access pattern. Candidates never wonder which password they used, because they never set one.

The bottom line

Passwords in recruiting are a solved problem. The solution is to remove them.

The evidence points one direction. 57% of respondents cited complex processes and lack of transparency as reasons for abandoning (LiveCareer). They fail on mobile, where most candidates apply (Appcast). They create security vulnerabilities through credential reuse (LastPass). And they send a clear message to candidates: your time does not matter to us.

Magic links remove the need to create and reset a portal password. They do not resolve every security issue or guarantee more completed applications. Their benefit is a simple return path through email.

We killed passwords for candidates because the data left us no other honest choice. If your ATS still asks candidates to create an account, you are losing talent before they even get through the door.

Try Kit free and see what a passwordless candidate experience looks like.