When I Do Header

Passkeys, Explained Without the Jargon

Cyber Security Concerns In The Global Wake of Hacking Threat
Cyber Security Concerns In The Global Wake of Hacking Threat / Leon Neal/GettyImages

Websites have started asking a new question at sign-in: would you like to create a passkey? Many people tap "not now" because the word is unfamiliar and the explanations are full of terms like "public key cryptography" and "FIDO2". The idea underneath is simpler than the vocabulary. A passkey lets you sign in to a site the same way you unlock your phone, with your face, fingerprint or PIN, and nothing you could be tricked into typing is involved.

The terms below are the ones you are likely to run into, in roughly the order they matter.

The basic idea

Passkey. A replacement for a password, made of a matched pair of digital keys. When you create one, your device makes both keys at once. One stays with you, and one goes to the website.

Public key. The half the website keeps. It can check your sign-in but can't be used to sign in on its own, so if the site is breached, there is nothing useful for an attacker to steal and reuse.

Private key. The half that never leaves your phone, computer or password manager. When you sign in, the site sends a one-time challenge, your device signs it with the private key, and the site checks the signature against the public key it holds.

Biometrics. Your face or fingerprint is only used to unlock the private key on your own device, exactly as it is when you unlock your screen. It isn't sent to the website, and the site never sees it.

The organizations behind it

FIDO Alliance. The industry group that developed the standards passkeys are built on. Its members include the major phone, computer and browser makers as well as banks and payment companies.

WebAuthn. The web standard, published by the World Wide Web Consortium, that lets browsers and websites talk to your device's keys. In 2022 Apple, Google and Microsoft committed to supporting passkeys across their platforms, and the feature is now built into iOS, Android, macOS, Windows and the major browsers.

Where your passkeys live

Synced passkey. The most common kind. It is stored in a password manager and copied, encrypted, to your other devices. Apple devices keep them in iCloud Keychain and Android devices in Google Password Manager, and several third-party password managers, including 1Password, Bitwarden and Dashlane, can store and sync them across brands, which helps if you use an iPhone with a Windows laptop.

Device-bound passkey. A passkey that lives on a single piece of hardware and can't be copied, most often a physical security key that plugs into a USB port or taps against a phone. These are popular with workplaces and people who want the strictest setup, and they need a spare in case one is lost.

Signing in on someone else's computer. If a device doesn't have your passkey, the site can show a QR code. You scan it with your phone, and the phone confirms the sign-in after a short-range Bluetooth check that proves it is physically nearby. That proximity check is what stops someone on the other side of the world from using a stolen QR code.

Why it is safer

Phishing. A convincing fake sign-in page can collect a typed password. A passkey is tied to the real website's domain, so your device simply won't offer it on a lookalike site, however good the copy.

Reuse. Many people use the same password on several sites, so one breach unlocks many accounts. Every passkey is unique to a single account.

Data breaches. A site that stores only public keys has nothing in its database that can be replayed to log in as you.

The weak point, and how to cover it

Because synced passkeys are backed up to your Apple, Google or password manager account, they reappear when you sign in on a new phone. The real risk is losing access to that account itself. Keep its recovery options current, such as a backup email, a recovery key or a trusted recovery contact. For important accounts, keep a second way in, such as a second passkey on another device or the old password stored safely, since passwords and passkeys can coexist on the same account.

Where to start

  1. Your main email account, since it can reset almost every other account you have.
  2. Accounts that hold money, such as banking, payment and shopping sites. Google, Apple, Microsoft, Amazon, PayPal and many banks already support passkeys.
  3. Everything else, gradually, whenever a site offers the option at sign-in.

Setting one up usually takes a minute: sign in as normal, look for a passkey option in the account's security settings, and confirm with your face, fingerprint or device PIN. The next time you sign in, choose the passkey instead of typing a password.