What is a passkey, and why should you care?
Oct 9th, 2024 by Jesper Kråkhede
Passkeys are one of the few security improvements that are both safer and, in many cases, easier for the user. Let me explain.
A passkey is a credential based on public key cryptography, built on the FIDO standards. When you register a passkey with a service, your device creates a key pair. The private key stays on your device, protected by its secure hardware and unlocked with your fingerprint, face or PIN. The service only gets the public key.
When you log on, the service sends a challenge, your device signs it with the private key, and the service verifies the signature. There is no password to type, steal or reuse.
Why is it so much safer? Because a passkey is bound to the real website. If you end up on a phishing site that looks exactly like your bank, your device simply won´t use the passkey there. That is something no password, SMS code or authenticator app code can do. It is phishing resistant by design.
And because the service only stores public keys, a breach of the service doesn´t leak anything an attacker can use to log on as you.
This year the big platforms have taken large steps. Microsoft added passkeys for personal Microsoft accounts and is bringing them to work accounts through the Authenticator app. Apple, Google and the password managers can sync passkeys between your devices.
My advice: turn on passkeys wherever you can. Start with your email, because that is the key to resetting everything else.
The best password is the one that doesn´t exist.