Passkeys: what they are and why they are replacing passwords

Passwords have a flaw underneath everything else. To work they have to be secret, but to use them you have to write them down somewhere, and anything you write down can be stolen, guessed or coaxed out of you by a fake website. Passkeys were created to solve the problem at its root, and within a few years they have gone from experiment to a standard adopted by the major online services.

How they work

A passkey is a pair of cryptographic keys created by your device when you sign up to a site. The private key stays protected by the operating system and is never shown to the site: if you have turned on syncing, it travels only in encrypted form between your own devices, inside Apple’s keychain, Google’s, or whichever manager you use. Only the public key is sent to the site. When you log in, the site sends a “challenge” and your device signs it with the private key, after asking for your fingerprint, face or unlock PIN.

What that means day to day is no password to remember, nothing to type into the site, and no secret word a criminal can trick you into handing over with a fake page. What is left to protect is the unlock code of the device itself. And a phishing site imitating your bank receives no password at all, because the passkey only works on the exact domain it was created for.

Where they are already available

Google, Apple, Microsoft, Amazon, PayPal, eBay, GitHub, WhatsApp and many others already let you sign in with passkeys. Some banks have begun to offer them, while national public services often still rely on their own schemes: in Italy, for instance, you still sign in to government services with SPID or the electronic ID card. Passkeys sync between devices through iCloud Keychain, Google Password Manager or password managers such as 1Password and Bitwarden, so you are not locked out when you change phone.

How to turn them on

Go to your account’s security settings (usually under “Sign-in” or “Password and security”), look for “Passkeys” and follow the steps. The device will ask for a biometric confirmation and the passkey is ready. I would keep the password switched on as a backup method, though, until you are sure the passkey is on at least two devices.

What changes for security

Passkeys take the two most common attacks out of the picture, phishing and the reuse of passwords stolen from other sites. With one caveat: they only pay off fully once the password is switched off, because as long as it sits there as a fallback, that is what anyone trying to trick you will aim for. Locking the device with a strong code and backing up the cloud account that syncs the keys stay important.

If your favourite service offers them, turning them on is probably the easiest security improvement you can make today. Start with your email account, then move on to the ones with money involved.