Passwords are the weakest link in online security. People reuse them, forget them and hand them to fake login pages. Passkeys are the industry's answer, and "passwordless" has become one of the fastest-rising search terms in security. We read the FIDO Alliance's own explanation, an NTT DATA analysis of phishing resistance and the passkey guides from Yubico and Google, and combined them into this plain-English overview.
Key takeaways
- A passkey is a pair of cryptographic keys. The private key never leaves your device; the website stores only the public key.
- Passkeys only work on the real website they were created for, which is why phishing pages get nothing.
- They can sync across your devices or stay bound to one device, and each has trade-offs.
- Plan recovery: keep a backup method and secure the account that stores your synced passkeys.
What Is a Passkey?
According to the FIDO Alliance, which maintains the open standard, passkeys are passwordless sign-in credentials built on the WebAuthn and CTAP specifications. Each passkey is a public/private key pair created for one account on one site. The website keeps the public key. Your device keeps the private key and only uses it after you unlock the device with a fingerprint, face, PIN or pattern. Your biometric data stays on the device; the site learns only that the check passed.
How Signing In Works
- You choose to sign in on a site and your device asks you to unlock it.
- The site sends a one-time challenge.
- Your device signs the challenge with the private key.
- The site verifies the signature with the stored public key and logs you in.
On a computer that does not hold your passkey, you can scan a QR code with a nearby phone and approve there; Bluetooth confirms the two devices are close together.
Why Passkeys Resist Phishing
NTT DATA explains the key idea: a passkey is bound to the domain it was created for. A look-alike site has a different domain, so your device will not offer the passkey. Sign-in is a cryptographic challenge-response, so there is no reusable secret that an attacker could capture and replay. Even "real-time" phishing, where a fake page relays your typed code to the genuine site, fails because there is nothing to relay. Compare that with other defences:
| Method | Can be typed into a fake page? | Reusable if stolen? |
|---|---|---|
| Password | Yes | Yes, and often reused across sites |
| Password + SMS or app code | Yes, the code can be relayed in real time | Short-lived, but usable immediately |
| Passkey | No, bound to the real domain | No secret leaves the device |
If you are not ready to switch, make sure you at least use a password manager and two-factor authentication.
Synced vs Device-Bound Passkeys
- Synced passkeys are end-to-end encrypted and held by a passkey provider, such as your phone's or browser's credential manager or a third-party password manager. They appear on every device you sign in to, including new ones. This is the convenient option for most people.
- Device-bound passkeys, such as those on a hardware security key, never leave the device. They give the highest assurance and suit strict compliance needs, but losing the key can mean losing access unless you registered a backup.
Benefits Beyond Security
The FIDO Alliance points to faster sign-in than typing a password, no one-time codes to enter, fewer password resets and lower costs than SMS-based authentication. A FIDO-commissioned 2024 survey reported that 53% of people had enabled passkeys on at least one account; as that figure comes from the alliance itself, treat it as an adoption indicator rather than independent data.
Caveats to Know
- Understanding. NTT DATA notes that many users do not yet understand passkeys, so good onboarding and FAQs matter.
- Cloud account risk. Synced passkeys live in a cloud account. If that account is compromised, passkeys could be misused, so protect it with a strong unique password and 2FA, and review connected devices.
- Ecosystem gaps. Syncing does not yet work across every provider, though support is growing.
How to Start Using Passkeys
- Update your phone, browser and password manager.
- In the security settings of major services (Google, Apple, Microsoft, PayPal and many others), look for "Create a passkey".
- Keep a recovery option, such as backup codes or a second registered device.
- Secure the account that syncs your passkeys.
Should Your Business Support Passkeys?
If you run a site or app with user accounts, probably yes. Passkeys reduce account-takeover risk, cut password-reset requests and make sign-in smoother. Google's developer guidance advises keeping existing sign-in methods alongside passkeys for now, since some users have incompatible devices or are hesitant. Our companion article explains how to add passkey login to your website. They also strengthen your defences against ransomware; see ransomware protection for small business.
References and further reading
This guide was compiled from the sources below. We compared them, kept the points they agree on and wrote the article in our own words. Check the originals for more detail.
- Passkeys (FIDO Alliance)
- Authentication technology "Passkey" attracting attention for phishing attack resistance (NTT DATA)
- Passkey relying party implementation guidance (Yubico)
- Passkeys developer guides (Google for Developers)
