You have probably seen it by now. You go to sign in somewhere and instead of a password, the site asks for your fingerprint, your face, or the PIN you use to unlock your phone. Two seconds later you are in. No typing, no texted code, no “which of these was your first pet” nonsense.
That is a passkey, the technology quietly replacing passwords across the internet. It is genuinely better, not in a marketing way but in a boring structural way, and you will be asked to use one soon whether you plan for it or not. Here is what it is, why it works, and where it is still awkward.
What a Passkey Actually Is
In one sentence: a passkey is a secret that lives on your device and proves who you are without ever being sent anywhere, so you unlock it the same way you unlock your phone.
The FIDO Alliance, the industry group that writes the standard, defines a passkey as “an authentication credential based on FIDO standards, that allows a user to sign in to apps and websites with the same process that they use to unlock their device (biometrics, PIN, or pattern).” Google’s help documentation describes passkeys more simply as “a simple and secure alternative to passwords.”
The mechanics, translated: creating a passkey generates a matched pair of keys. One is private and stays on your device. The other is public and goes to the website. At sign in, the site poses a math problem only the private key can answer, and your device answers after you unlock it. The FIDO Alliance is explicit that the private key never leaves your device. Your fingerprint does not go anywhere either. It unlocks the key locally.
Why It Cannot Be Phished or Reused
- There is nothing to hand over. The FIDO Alliance puts it directly: with passkeys “there are no passwords to steal and there is no sign-in data that can be used to perpetuate attacks.” A fake login page can ask all day. There is no secret to type into it.
- It is bound to the real site. A passkey created for your bank only works at your bank’s actual web address. Land on a convincing copycat and your device simply will not offer it. Your device does not get fooled by a lookalike domain, and neither do you, because nothing happens.
- It cannot be reused. Each passkey is unique to one account on one site, so a breach at one company cannot expose your login somewhere else.
- It beats the codes you are used to. The Cybersecurity and Infrastructure Security Agency states that “the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication,” and describes text message based verification as vulnerable to phishing and SIM swap attacks and something to use only as a last resort. Passkeys are that FIDO based option.
That last point is worth sitting with. Someone can talk you into reading a texted code out loud. Nobody can talk you into reading a passkey out loud, because there is nothing to read.
Where Passkeys Live
This is the part that confuses people, because passkeys do not live in one place. You may have several homes for them without realizing it.
- Your phone or computer. The most common option. The device’s built in account system stores the passkey and unlocks it with your face, fingerprint, or PIN.
- A password manager. Most now store passkeys alongside passwords. This is the friendliest option if you mix devices from different companies, because the passkeys follow the manager instead of the ecosystem.
- A hardware security key. A small physical device you plug in or tap. The FIDO Alliance calls these device bound passkeys, meaning the key “never leaves a single device.” Our post on what a YubiKey is and how it works covers the category in plain language.
- Synced across your devices. The FIDO Alliance describes synced passkeys as copied “to all the user’s other devices using the same passkey provider,” with the sync end to end encrypted. Create one on your phone, find it on your laptop.
- Borrowed from a nearby phone. On a computer with no passkey, you can scan a code on screen with your phone and approve the sign in there. The FIDO Alliance built this as cross device authentication, using a QR code plus a short range check that the two devices are really near each other.
What Happens If You Lose the Device
Everyone asks this, and it is the right question. The answer depends on which kind of passkey you made.
If your passkey syncs, losing the phone is inconvenient rather than catastrophic. The passkey is already on your other devices and comes back when you sign in on a replacement. If it is device bound, on a hardware key for example, losing it means losing that credential, which is why people who use hardware keys buy two and keep the spare somewhere safe.
Either way, do the cleanup. Google’s guidance for a lost or stolen device is to sign in from another device and remove the passkey tied to the missing one. Every major provider offers that in the security area of account settings. And always keep one other way in: a second passkey, a printed recovery code, or a password you still have.
How to Start This Week
Do not try to convert your whole life. Convert two accounts and see how it feels.
- Start with your email account. It resets every other account, so it deserves your strongest protection.
- Look in the security section of your account settings. Providers put passkey setup under a heading like security, sign in, or how you sign in. The exact spot moves around, so browse rather than follow a memorized path.
- Create it and test it immediately. Sign out and back in while you are still sitting there. Ninety seconds of testing prevents a bad surprise later.
- Add a second passkey on a different device. One on the phone, one on the laptop or a hardware key. A lost device becomes a nuisance instead of a lockout.
- Then do one more. Your bank, or your main shopping account. Build from there whenever a site offers.
The Honest Rough Edges
We will not pretend this is finished technology. It is very good, still rolling out, and the seams show.
- Not every site supports them. Coverage keeps growing, but plenty of banks and small retailers still take only passwords.
- Moving between ecosystems is clumsy. Passkeys made inside one company’s system do not always travel gracefully to another. A password manager sidesteps most of this.
- The naming is a mess. Sites call the same feature a passkey, a security key, or passwordless sign in. They generally mean the same standard.
- Old devices may not qualify. Google’s help page lists minimum operating system and browser versions for passkey support. Check the provider’s current requirements if something will not work.
- The old password often still exists. Adding a passkey does not always remove the password behind it, so the weaker door stays open. Where a site lets you delete the password afterward, consider it.
The Bottom Line
Passwords asked ordinary people to invent, memorize, and never reuse dozens of long random strings, then correctly spot fake websites under time pressure. That was never a fair ask. Passkeys move the hard part onto the machine, where it belonged all along.
You do not need to be an early adopter. Just say yes the next time a site offers, starting with your email. Our breakdown of YubiKeys, passkeys, and multifactor authentication lays the three side by side if you want to compare before deciding.
And if you try one and it does something baffling, that is not a you problem. This technology is still smoothing out. We are glad to answer a question, no strings attached. Contact us today
Sources:
Comments are closed