Passkeys: How They Work and Where They Replace Passwords

Anyone who has seen a convincing fake of their bank’s login page knows how little vigilance helps. The address bar is nearly right, the logo is right, the form looks the same as always. People type passwords into those pages just as readily as into the real thing. A passkey won’t go there at all, and that is the real reason to switch.

What passkeys actually are

A passkey is a key pair based on the FIDO2 standard. FIDO2 has two parts: WebAuthn, a W3C browser API, and CTAP, the FIDO Alliance protocol browsers use to talk to authenticators such as your phone or a security key.

When you create a passkey, your device generates a fresh key pair just for that site. The public key goes to the site; the private key stays with you. At sign-in, the site sends a random challenge, your device signs it once you approve with a fingerprint, face or PIN, and the site checks the signature against the public key.

Two properties fall out of that design:

Why phishing doesn’t work against passkeys

Every passkey is tied to a relying party ID, in practice the site’s domain, such as paypal.com. The browser only offers the passkey when the page you’re on belongs to that domain. On paypal-security.example there is no matching passkey to offer. You can’t get it wrong, even if you don’t notice the fake.

This is also what sets passkeys apart from SMS codes and authenticator apps. A phishing page can capture a six-digit code and replay it in real time. A passkey signature includes the origin of the page, so relaying it gets the attacker nowhere.

Synced or device-bound

Passkeys come in two flavours:

• Synced passkeys live in iCloud Keychain, Google Password Manager or a standalone password manager such as Bitwarden or 1Password. They are available on all your devices and survive a new phone.
• Device-bound passkeys sit on a hardware key such as a YubiKey or are locked to one device. They can’t be copied, and they’re gone if the device is.

For most people synced passkeys are the better choice, because losing a phone stops being a crisis. For accounts that need extra protection, say an admin login or the registrar account for a company domain, add two hardware keys as well, with the spare kept somewhere else.

Synced passkeys move the risk to the account that stores them. Your Apple or Google account therefore needs strong protection itself, and so does the email address it recovers to. More on that in account recovery email on your own domain.

Where passkeys work today

The big platforms all support them: Google, Microsoft and Apple accounts, Amazon, PayPal, GitHub and many more. Implementations differ. Some sites let a passkey replace the password entirely; others treat it as a second factor and keep the password mandatory.

Windows 11, macOS, iOS and Android have passkey support built in, and Chrome, Safari, Edge and Firefox all support WebAuthn. You don’t need to buy anything to start.

The weak spots, honestly

Passkeys aren’t magic. Three things to know:

1. The password often stays. As long as a site still accepts a password alongside the passkey, the password is the weakest way in. Remove it where you can, or at least replace it with a random one.
2. Account recovery becomes the target. Someone who can reset your account through “I lost access” doesn’t need your passkey. That route usually ends in an email to your recovery address.
3. Moving between ecosystems used to be painful. Getting passkeys from Apple to Android was barely possible for a long time. The FIDO Alliance has since developed a credential exchange format, and some managers now support import and export. Check yours before you switch platforms.

On point two: if your recovery address is on your own domain, that domain must stay yours permanently. If it lapses, someone else can receive mail sent to that address.

Passkeys in your password manager

If you already use a password manager that supports passkeys, storing them there keeps all your logins in one place, independent of operating system. The trade-off is the same as with passwords: the vault itself needs serious protection.

After a data breach you can be far more relaxed about accounts that use passkeys. The site lost your public key, which nobody can do anything with.

A sensible place to start

Start with the accounts whose takeover would hurt most: email, your Apple or Google account, your password manager, your bank, and your domain registrar if you have one. Register two passkeys for each, on two different devices.

If your email addresses live on your own domain, the registrar account matters as much as the mailbox. At betadomain you manage your domain and its DNS records in one place, and renewal prices match the first year, so auto-renewal holds no surprises. If you’re still looking for a domain for your own email address, pick one you want to keep for the next twenty years.

Step by step

1. Check for passkey supportLook in the site's security settings for an entry such as passkeys, security keys or passwordless sign-in.
2. Choose where the passkey livesDecide whether to store it in your operating system's keychain, your password manager or on a hardware security key.
3. Create the passkeyStart setup on the site, confirm with fingerprint, face or device PIN, and give the passkey a recognisable name.
4. Add a second way inRegister a second passkey on another device or security key, or save the site's recovery codes offline.
5. Test the sign-inSign out and back in with the passkey before you remove or forget the password.