On this page
What Are Passkeys (and Should You Switch)?
Passkeys replace passwords with cryptographic key pairs unlocked by your device, resisting phishing. Learn how they work and whether to switch.
Quick answer
- A passkey is a cryptographic credential that lets you sign in with your device (fingerprint, face, or PIN) instead of a password.
- It’s built on the FIDO2/WebAuthn standards and is inherently phishing-resistant.
- Yes, you should switch: passkeys are both easier and more secure than passwords for most users.
What is a passkey?
A passkey is a passwordless credential based on public-key cryptography. When you create one, your device generates a key pair: the private key stays on your device (protected by your fingerprint, face, or PIN), and the public key goes to the website. Signing in means proving you hold the private key, which unlocks only after your local biometric or PIN check. No shared secret is transmitted, and there’s no password to steal.
How it works
At login, the site challenges your device to prove it holds the private key for that account. Your device asks for the same local unlock you use every day — a fingerprint or face scan — then answers the challenge cryptographically. Because the private key never leaves the device and is bound to the site’s origin, an attacker can’t phish it or replay it elsewhere.
Why it’s phishing-resistant
A password can be typed into a fake site; a passkey cannot. The key only answers a challenge from the real origin it was created for, so a lookalike phishing page gets nothing usable. This is why passkeys (and FIDO2 hardware keys) are the recommended baseline for phishing-resistant MFA, and why major platforms have made them the default login.
Where this bites vibecoders
When building auth, the easy default is “username and password,” because that’s what AI assistants generate without prompting. But implementing passkeys as the primary login — or at least the MFA method — removes the two most common failure classes at once: weak passwords and phishing. The trade-off is more integration work, which is exactly why the default matters.
Where AI coding assistants get this wrong
- Defaulting to password auth without suggesting passkeys or WebAuthn.
- Implementing password reset flows that become the weakest link anyway.
- Storing password-equivalent secrets when a cryptographic challenge would do.
Checklist
- Offer passkeys as a primary login for new accounts.
- At minimum, add a FIDO2/WebAuthn option as MFA.
- Keep password recovery tightly scoped if passwords remain.
- Allow multiple passkeys per account for device-loss recovery.
- Test the full flow on real devices, not just the happy path.
FAQ
What happens if I lose my device?
Most platforms let you register multiple passkeys and recover through the account’s recovery process (which may involve fallback methods). Because passkeys sync across devices in ecosystems like iCloud or Google, losing one device usually doesn’t lock you out.
Are passkeys the same as two-factor authentication?
Not exactly. A passkey is a single-factor, passwordless credential that’s phishing-resistant by design. It can also serve as a strong second factor. The key difference from SMS or app codes is that it can’t be phished.
Do passkeys work everywhere?
Support is now broad across operating systems, browsers, and major sites, though some legacy systems still require passwords. Adoption is the main remaining constraint, not capability.