Passkeys and the end of passwords
How FIDO2 passkeys work, why they stop phishing, and what organisations need to change to adopt them.
For thirty years we have asked people to remember secrets, never reuse them, change them regularly and type them only into the right website. People cannot do that, and attackers know it. Stolen and phished credentials remain one of the most common ways into an organisation.
Passkeys are the first replacement for passwords that is both more secure and easier to use. Here is how they work and what it takes to adopt them.
What a passkey is
A passkey is a credential based on the FIDO2 / WebAuthn standards. Instead of a shared secret, it uses a key pair:
- The private key stays on the user's device or in their password manager, protected by the device unlock (fingerprint, face or PIN).
- The public key is stored by the service. It is useless to an attacker who steals the database.
To sign in, the service sends a random challenge, the device signs it with the private key after the user unlocks it, and the service verifies the signature with the public key. No secret ever travels over the network.
Why passkeys stop phishing
This is the most important property. A passkey is bound to the website's domain (the "relying party"). The browser will only use the passkey for example.com on example.com. A perfect copy of the login page on examp1e-login.com simply gets nothing.
Compare that with the alternatives:
| Method | Phishing-resistant? | Why |
|---|---|---|
| Password | No | The user can type it anywhere |
| SMS or e-mail code | No | Codes can be relayed by a fake site in real time |
| Authenticator app code (TOTP) | No | Same relay problem |
| Push approval | Partly | Vulnerable to "MFA fatigue" unless number matching is used |
| Passkey / FIDO2 security key | Yes | Cryptographically bound to the real domain |
Synced or device-bound?
There are two kinds of passkeys, and the choice matters for organisations:
- Synced passkeys are backed up to the user's platform account or password manager and available on all their devices. They are great for consumers, because losing a phone doesn't lock you out.
- Device-bound passkeys live on a hardware security key or in a managed device and cannot be copied. They are the right choice for administrators and high-risk roles, where you need to know exactly where the credential is.
What organisations need to change
- Start with administrators. Privileged accounts give the biggest risk reduction per passkey issued.
- Fix account recovery first. If "I lost my passkey" falls back to an e-mail link or a help-desk call with a few personal questions, the attacker will simply use recovery. Recovery must be at least as strong as the sign-in.
- Plan for shared and kiosk devices, where personal biometrics don't apply. Security keys usually solve this.
- Remove the password, don't just add a passkey. As long as the password still works, phishing still works. The goal is a passwordless account, not an extra option.
- Measure adoption. Track the share of sign-ins that use phishing-resistant methods, not just the number of registered passkeys.
For everyone at home
If your e-mail provider, bank or password manager offers passkeys, turn them on. Start with your e-mail account: whoever controls your e-mail can reset almost everything else.