Learn About Passkeys and Online Security

What Are Passkeys and How Do They Work?

Passkeys are a modern method of signing into accounts that replaces traditional passwords. Instead of typing a long string of characters, passkeys use a combination of something you have (like your phone or computer) and something you are (like your fingerprint or face). This technology is sometimes called passwordless authentication, and it's becoming more common across websites and apps.

When you set up a passkey, your device creates two linked codes: a public key that stays on the website's servers and a private key that stays on your device. When you want to sign in, your device uses its private key to prove you're really you, without ever sharing that private key with the website. Think of it like having a unique lock and key combination that only your device knows.

The technology behind passkeys comes from standards created by organizations like the FIDO Alliance and the World Wide Web Consortium. These groups work to make internet standards that many companies agree to follow. As of 2024, major companies including Apple, Google, and Microsoft have all built passkey support into their devices and services. This widespread support means passkeys are becoming available on more websites than ever before.

Passkeys can use different types of verification depending on your device. Fingerprint scanning is the most common method, but facial recognition is also widely supported. Some devices may use a PIN number instead. The exact method depends on what your phone, tablet, or computer offers.

Practical Takeaway: Passkeys work by having your personal device verify your identity instead of you typing a password. This approach is more secure because your device never shares its secret key with websites.

Why Passkeys Are More Secure Than Passwords

Traditional passwords have a major weakness: humans create them, and human-created passwords are often weak or predictable. Studies show that many people choose passwords like "123456," "password," or "qwerty." According to research by the password manager NordPass, these weak passwords appear in billions of leaked password databases. When passwords are reused across multiple websites, a breach at one company can put all of a person's accounts at risk.

Passkeys solve this problem because they don't rely on you remembering anything. Since the system generates the passkey automatically, it's always strong and random. A passkey is mathematically impossible to guess. Even if someone steals a list of passkeys from a website's servers, those passkeys can't be used somewhere else. This is because each passkey is specific to one website and won't work on any other site.

Phishing is another common attack where criminals trick you into typing your password on a fake website. Passkeys protect against phishing because they only work with the real website they were created for. If you accidentally visit a fake website, your device won't create the authentication signal needed to sign in, even if the site looks identical to the real one.

Passkeys also prevent password spraying attacks, where hackers try thousands of common password combinations against many accounts. Since passkeys aren't passwords, these attacks don't work. Additionally, passkeys eliminate the risk of passwords being intercepted during transmission, as the actual passkey secrets never leave your device.

The National Institute of Standards and Technology (NIST) has been recommending the shift away from passwords for several years. In their 2023 guidelines, they emphasize that passwordless methods like passkeys represent a significant security improvement for both individuals and organizations.

Practical Takeaway: Passkeys are harder to steal, impossible to reuse across different sites, and can't be fooled by fake websites. They remove the weakest link in password security: the human factor.

Setting Up Passkeys on Your Devices

The process of creating a passkey is straightforward on most modern devices. Here's how it typically works across different platforms:

• On iPhone and iPad: Open the website or app, look for the sign-in options, and select the passkey or "Sign in with Passkey" button. Your device will ask you to verify your identity using Face ID, Touch ID, or your device PIN. That's usually all it takes. Your passkey is then saved in iCloud Keychain, which is Apple's secure storage system.
• On Android devices: The process is similar. Open the website or app, select the passkey option, and verify using your fingerprint, face recognition, or PIN. Google saves your passkey in Google Password Manager, which is built into Android.
• On Windows computers: When creating a passkey, Windows may ask you to use Windows Hello, which uses facial recognition or fingerprint scanning. If your computer doesn't have these features, you can use a PIN instead.
• On Mac computers: Similar to iPhone, you can set up a passkey using Touch ID or Face ID if your Mac has these features. The passkey saves to iCloud Keychain.

Before setting up a passkey, make sure your device is updated to the latest version. Older devices may not support passkeys. Check your device's settings to confirm that biometric options like fingerprint or face recognition are enabled and working properly.

One important feature of passkeys is that they sync across your devices when you use the same account. If you set up a passkey on your iPhone, you may be able to use it to sign in on your iPad or Mac as well, depending on how the website has configured passkey support. However, you typically need to set up separate passkeys on devices from different manufacturers (like signing in on a Windows computer when you primarily use an iPhone).

Many websites are still transitioning to passkey support, so you may find that not all sites offer this option yet. Common sites that now support passkeys include Google, Microsoft, Apple, PayPal, Dashlane, and GitHub. More companies are adding support regularly.

Practical Takeaway: Setting up a passkey usually takes less than a minute and involves confirming your identity with your fingerprint or face. Make sure your device is updated and that biometric features are turned on before you start.

Passkeys and Password Managers: How They Work Together

Password managers and passkeys serve related but different purposes in your online security. Understanding how they work together can help you choose the right tool for different situations.

Password managers are software programs or services that store all your passwords in an encrypted vault. Examples include 1Password, Dashlane, LastPass, and Bitwarden. They help you create strong, unique passwords for each website and remember them so you don't have to. Password managers still play an important role in security because not every website supports passkeys yet. As of early 2024, passkeys remain unavailable on many websites, so password managers will remain necessary for years to come.

The good news is that most major password managers now support storing and managing passkeys. This means you can use one tool to manage both your passwords and your passkeys. When you visit a website that supports passkeys, the password manager can help you create and manage the passkey. When you visit a site that doesn't support passkeys, you can still use the password manager to fill in your password.

Built-in password managers on your device also support passkeys. iCloud Keychain (Apple), Google Password Manager (Android), and Windows Vault (Windows) all allow you to store passkeys alongside passwords. The advantage of using your device's built-in system is that it's already integrated into your operating system and requires no separate software.

Some people prefer using both their device's built-in password manager and a separate password manager application for added flexibility. For example, you might use iCloud Keychain for passkeys and passwords on Apple devices, while also using a third-party password manager for accounts across multiple device types.

When choosing a password manager, look for one that supports passkey storage and management, offers strong encryption, and comes from a reputable company with good security practices. Many password managers offer free versions with basic features and paid versions with more advanced options.

Practical Takeaway: Password managers and passkeys work together to improve your security. As websites add passkey support, you can use your password manager to store both passkeys and traditional passwords in one secure location.

Real-World Examples and Implementation Status

Understanding which websites and services currently support passkeys can help you decide where to prioritize using them. Several major