Passkeys explained why passwords are finally on the way out

[Darren91]

TL;DR

• A passkey replaces a password with a cryptographic key pair: the private key stays on your device or in your password manager, and the website only stores the public key
• Passkeys are phishing resistant because they are bound to the real website, so a fake lookalike site cannot trick them into working
• The FIDO Alliance estimated on World Passkey Day in May 2026 that around 5 billion passkeys were in use, and 75 percent of consumers surveyed had enabled one on at least one account
• NIST's Digital Identity Guidelines SP 800-63-4, finalised in 2025, recognise synced passkeys as suitable for AAL2 authentication
• Weak points remain in account recovery, cross platform portability and older devices, but standards such as the FIDO Credential Exchange specifications are closing gaps
• For Q-Day watchers, passkeys mostly use elliptic curve signatures today, so they will eventually need a post quantum upgrade, which their design makes easier than passwords

The problem with passwords

Passwords have been the default way to sign in for more than half a century, and they have aged badly. People reuse them across sites, choose ones that are easy to guess and type them into convincing fake pages. Attackers exploit all three habits at enormous scale. Credential stuffing, phishing and password spraying remain among the most common ways accounts are compromised

Defenders have layered fixes on top. Password managers help people use unique, strong passwords, and multi factor authentication adds a second check such as a code from an app or a text message. These measures help a great deal, yet many second factors can still be phished. A realistic fake login page can capture both a password and a one time code and replay them instantly

Passkeys take a different approach. Instead of patching the weaknesses of shared secrets, they remove the shared secret entirely. The result is a sign in method that is both easier for users and much harder for attackers. That rare combination explains why the whole industry has rallied behind it

How passkeys work

A passkey is built on public key cryptography, standardised by the FIDO Alliance and the W3C through specifications known as FIDO2 and WebAuthn. When you create a passkey for a website, your device generates a pair of keys. The private key stays with you, protected by your device or password manager, while the public key is sent to the website. The site never learns anything that would let someone sign in as you

When you sign in, the website sends a random challenge. Your device asks you to unlock it, usually with a fingerprint, face scan or device PIN, then signs the challenge with the private key. The website checks the signature using the public key it stored earlier. If the signature is valid, you are in

Crucially, the biometric or PIN never leaves your device. It simply unlocks the private key locally. Websites do not receive your fingerprint or face data. This design protects privacy as well as security

Passkeys also remove the need to remember anything for each site. There is no password to invent, no complexity rule to satisfy and nothing to reset when you forget. For many people that convenience is the real selling point. Security improves almost as a side effect

Why passkeys stop phishing

Each passkey is tied to the specific website domain it was created for. Your browser or operating system checks the domain before using the key, so a passkey for your bank will simply not work on a lookalike site with a slightly different address. You cannot be tricked into handing it over, because there is nothing to type and nothing to copy. That property, called phishing resistance, is the biggest security benefit

Data breaches also lose much of their sting. If attackers steal a website's database, they get public keys, which are useless for signing in. There are no password hashes to crack and no reused passwords to try elsewhere. Credential stuffing attacks against passkey accounts simply have nothing to work with

Security agencies have recognised these benefits. Guidance from bodies including the US CISA and the UK NCSC encourages phishing resistant authentication, and FIDO based methods are the leading example. In the United States, NIST's revised Digital Identity Guidelines, SP 800-63-4, finalised in 2025, recognise synced passkeys as meeting the AAL2 assurance level used by many government and enterprise services. That formal recognition has encouraged wider adoption

Synced and device bound passkeys

There are two broad kinds of passkey. Synced passkeys are stored in a password manager or platform account, such as Apple's iCloud Keychain, Google Password Manager or independent managers like 1Password and Bitwarden, and are available across your devices. They are convenient and make recovery easier if you lose a phone. Most consumers use this kind

Device bound passkeys live on a single piece of hardware, typically a security key such as a YubiKey or a device's secure chip, and cannot be copied. They offer the highest assurance and suit administrators, journalists, executives and anyone at elevated risk. Many organisations issue them to privileged staff. Losing the device means relying on a backup key or recovery process

Choosing between them is about balancing convenience and assurance. For most people, synced passkeys protected by a strong account and device lock offer an excellent upgrade over passwords. High risk users benefit from adding hardware keys. Both are far better than passwords alone

Using a passkey on a device that does not hold it is possible too. Many systems let you scan a QR code with your phone to sign in on a nearby computer, with Bluetooth used to confirm the phone is physically close. This cross device flow keeps the private key on your phone. It also helps on shared or borrowed computers

Adoption in 2026

Adoption has grown quickly since Apple, Google and Microsoft committed to passkeys in 2022. On World Passkey Day in May 2026, the FIDO Alliance estimated that around 5 billion passkeys were in use worldwide. Its survey of 11,000 consumers across ten countries found that 90 percent were aware of passkeys, 75 percent had enabled one on at least one account and 49 percent used them regularly when available. More than 200 organisations had signed the Alliance's Passkey Pledge

Workplaces are following. In the same research, 68 percent of 1,400 organisational decision makers said they had deployed or were deploying passkeys for employee sign in, and 82 percent described fully passwordless authentication as an ultimate goal. Yet 57 percent still relied on phishable methods for primary day to day sign in. The transition is well under way, but far from finished

Major consumer services now offer or default to passkeys. Microsoft announced in May 2025 that new Microsoft accounts would be passwordless by default, and Google, Apple, Amazon, PayPal and many banks and retailers support passkey sign in. Each service that switches reduces the value of stolen passwords. Momentum like this is why many security professionals now talk about passwords being on the way out

Remaining challenges

Account recovery is the weakest link. If a user loses all devices and cannot access their synced passkeys, services must offer some other way back in, and attackers target those recovery paths. Recovery by email or text message can reintroduce phishing risk. Well designed services combine passkeys with strong recovery options such as backup security keys or identity verification

Portability has been a frustration. Early passkeys were often tied to one ecosystem, making it hard to move between, say, an iPhone and a Windows laptop or between password managers. The FIDO Alliance has developed Credential Exchange specifications to let users move passkeys securely between providers, and Apple announced support in 2025. As these standards roll out, switching providers should become much easier

Consistency and user understanding also matter. Different sites present passkeys in different ways, and some users are unsure what a passkey is or where it is stored. Clear wording, sensible defaults and gentle prompts help. Shared device scenarios, such as a family computer, need thought too

Organisations face their own adoption questions. Some older applications and identity systems need upgrades before they can accept passkeys, and help desks need new processes for enrolment and recovery. Pilots with a small group of staff reveal these issues early. Most organisations find the effort worthwhile once phishing incidents fall

The Q-Day angle

Passkeys use public key signatures, and today most use ECDSA on the P-256 elliptic curve. That makes them, like most current public key systems, theoretically vulnerable to a future cryptographically relevant quantum computer running Shor's algorithm. In practice, an attacker would need such a machine plus the public key for a specific account to forge a signature. This is a long term concern rather than an immediate risk

Importantly, passkeys are far easier to upgrade than passwords. Because the standard negotiates which algorithm to use, services and authenticators can add post quantum signature algorithms such as ML-DSA as the ecosystem matures, then gradually re-enrol users. Work on post quantum options for FIDO authentication is already being explored by researchers and industry. Passwords, by contrast, offer no path to quantum resistance at all beyond being phished more slowly

Users will not need to do much themselves when that happens. Re-enrolment can be prompted at sign in, much like the gentle nudges services use today to encourage passkey adoption. Old and new keys can coexist during the transition. That smooth path is another argument for adopting passkeys now

How to start using passkeys

• Turn on passkeys for your most important accounts first: email, cloud storage, banking and password manager
• Keep your device lock strong, with a good PIN plus fingerprint or face unlock
• Use a password manager or platform account you trust to sync passkeys across devices
• Set up recovery options carefully, and consider a hardware security key as a backup for critical accounts
• Remove old passwords or keep them strong and unique where sites still require them
• For organisations, start with administrators and high risk staff, then expand

Closing thoughts

Passkeys are one of the most encouraging developments in everyday security for years. They make signing in faster for users while shutting down phishing and credential stuffing for attackers. Adoption has reached billions of passkeys, governments recognise them, and the remaining challenges are being actively addressed. Passwords will linger for a while, but their decline has clearly begun

Please share your experiences with passkeys in the replies, including what went smoothly and what confused you. Practical tips for families, small businesses and less technical relatives would be especially helpful. Every successful switch makes the internet a little safer


Key references for citation

• FIDO Alliance, World Passkey Day 2026 report and survey, May 2026
• W3C, Web Authentication (WebAuthn) specification; FIDO Alliance, FIDO2 and CTAP specifications
• NIST SP 800-63-4, Digital Identity Guidelines, 2025
• Microsoft, passwordless by default announcement for new accounts, May 2025
• FIDO Alliance, Credential Exchange Protocol and Format specifications