Passkeys Are Replacing Passwords in the New Era of Digital Security

For nearly five decades, passwords have been the standard method for securing digital accounts. But growing risks from credential theft, phishing and automated login attacks are pushing technology companies and standards organizations toward passwordless authentication.

Passkeys are designed to replace traditional passwords by combining public-key cryptography with authentication performed locally on a user's device. Instead of entering a password on a website, users can verify their identity through a fingerprint, face scan or device PIN.

According to industry surveillance data cited from the FIDO Alliance, global consumer awareness of passkeys has reached 90%, while roughly three-quarters of users have activated passkeys on at least one account they use regularly.

AI Cyber Arms Race Accelerates Deepfake and Automated Threats

How passkeys work

Passkeys are based on open standards developed by the FIDO Alliance and the World Wide Web Consortium (W3C), incorporating technologies including WebAuthn and CTAP2.

When a passkey is created, the user's device generates a unique cryptographic key pair: a public key and a private key.

The public key is provided to the website or application server and stored there. The private key remains protected on the user's device and is not normally transmitted to the server.

During login, the server sends the device a random cryptographic challenge. The device uses the private key to digitally sign that challenge. The signed response is then returned to the server, which verifies it using the stored public key. If the signature is valid, the user is authenticated.

The accompanying diagram illustrates this process, showing registration, generation of the asymmetric key pair, a random login challenge, local biometric unlocking and verification of the signed challenge using the public key.

Why passkeys are resistant to phishing

One of the biggest weaknesses of passwords is that users can be tricked into entering them on fake websites. Some reverse-proxy phishing attacks can also target accounts protected by SMS or authenticator-based two-factor authentication.

Passkeys address this problem by binding the cryptographic authentication process to the website's verified domain through WebAuthn. If a user is redirected to a fraudulent domain that resembles a legitimate website, the domain mismatch prevents the authentication credential from being used for that site.

This makes passkeys significantly more resistant to phishing than conventional password-based authentication.

How AGI Could Work and Why It Differs From ChatGPT

How biometrics are handled

A common misconception is that passkeys send fingerprints or facial information to technology companies. In a passkey system, biometrics primarily serve as a local method for unlocking authentication on the device.

When a user verifies their identity with a fingerprint or face scan, the device's operating system authorizes use of the protected private key. Raw biometric information is not normally sent to the website's server.

Passkeys across major platforms

Passkeys are supported across major operating systems and services, including iOS, Android, macOS and Windows. Independent password managers also support the technology.

Apple users can synchronize passkeys across supported devices through iCloud Keychain. Google supports passkey synchronization through Google Password Manager across Android devices and Chrome. Microsoft provides passkey functionality through Windows Hello and Microsoft accounts.

AI's Power Crunch: Why Tech Giants Are Turning to Nuclear Energy

Creating a passkey generally involves opening the Security or Sign-in Options section of a supported service and selecting the option to create a passkey. The device then prompts the user to verify their identity using a face scan, fingerprint or PIN.

For synchronized passkeys, maintaining a suitable backup or synchronization system can help prevent loss of account access if a primary device is damaged or lost. Options include iCloud Keychain, Google Password Manager and third-party password managers.

For environments requiring higher levels of security, physical hardware authenticators such as YubiKeys can also be used. These devices can keep private keys unsynchronized and isolated from cloud backups, reducing reliance on cloud-based credential storage.

As passkeys become more widely adopted, digital identity is increasingly moving away from secrets that users must remember and toward a combination of cryptographic keys, trusted devices and local identity verification.