Passkeys Explained: Why Your Passwords Are Being Replaced

For decades, the password has been the front door to almost everything we do online, and it has also been the weakest lock. Passwords are reused, guessed, stolen in data breaches and handed over to convincing fake login pages. Passkeys are the technology the major platforms are now promoting as a replacement. Here is what they are, why security experts favour them, and what to think about before switching.

Key points

• A passkey is a login credential based on public-key cryptography, created for one specific website or app.
• The secret part never leaves your device or password manager; the website stores only a public key that is useless to thieves.
• Passkeys resist phishing because they only work on the genuine site they were created for.
• You unlock a passkey the same way you unlock your phone or computer, with a fingerprint, face scan or PIN.

How a passkey works

When you create a passkey for a website, your device generates a matched pair of cryptographic keys:

• A private key, which stays on your device or inside your password manager and is never sent to the website.
• A public key, which the website stores in your account.

When you sign in, the website sends a random “challenge.” Your device signs that challenge with the private key, but only after you confirm it is you, using biometrics or a device PIN. The website checks the signature with the public key. If it matches, you are in. No secret was typed, transmitted or stored on the server.

Passkeys are built on open standards developed by the FIDO Alliance and the World Wide Web Consortium (W3C), which is why the same approach works across Apple, Google and Microsoft devices and in major browsers.

Why passkeys are safer than passwords

They defeat most phishing. A passkey is tied to the exact web address of the service that created it. If a scammer sends you to a look-alike site, your device simply has no passkey for that address, so there is nothing to hand over.

Server breaches expose less. When a company storing passwords is breached, attackers may be able to crack or reuse those passwords. With passkeys, the company holds only public keys, which cannot be used to log in.

No reuse, no weak choices. Every passkey is unique and generated by the device, so the familiar problems of short, guessable or recycled passwords disappear.

Synced versus device-bound passkeys

There are two broad kinds:

• Synced passkeys are backed up through a credential manager, such as Apple’s iCloud Keychain, Google Password Manager or a third-party password manager, so they are available on your other devices and can be restored if you lose your phone.
• Device-bound passkeys live on a single piece of hardware, such as a physical security key. They are popular in high-security workplaces because the secret cannot be copied off the device, but losing the key means you need a backup method.

What to consider before switching

• Recovery. Make sure the account where your passkeys sync is itself well protected, and keep at least one recovery option, a second device, a backup security key or recovery codes.
• Shared and older devices. On a computer that does not have your passkey, you can usually sign in by scanning a QR code with your phone, which then confirms the login.
• Not every site supports them yet. Many large services do, but you will likely use a mix of passkeys and passwords for some time. A password manager handles both.
• Keep two-factor authentication on accounts that still use passwords. Until a service offers passkeys, a password manager plus an authenticator app remains the best defence.

How to start

1. Choose where your passkeys will live: your phone’s built-in credential manager or a password manager you already use.
2. Begin with your most important accounts, email, banking and the account that controls your phone or password manager.
3. Look in each service’s security settings for an option such as “Create a passkey” or “Sign in with a passkey.”
4. After creating one, sign out and back in to confirm it works before removing any older sign-in methods.

The bottom line

Passkeys do not make you invulnerable, and the transition will take years. But they remove the most common ways accounts are taken over: stolen, reused and phished passwords. For most people, turning them on for key accounts is one of the simplest security upgrades available today.

Sources

• FIDO Alliance, Passkeys
• Passkeys.io, How do passkeys work? (technical details)
• Okta, How passkeys work: a technical primer