How Passkeys Work and Why They're Replacing Passwords

Somewhere in your head is a short list of passwords doing far too much work. The one with the capital letter and the number you keep bumping up. The one you typed into a site two years ago that turned out to be a copy of a site you actually use. The reset link that always seems to arrive while you're standing in a queue.

Passkeys are the industry's attempt to retire all of that, and unlike most security advice, this one is genuinely more convenient than what it replaces. Here's what's actually happening when you tap that button, where the technology still falls short, and the order in which to switch your accounts over.

What a passkey actually is

A passkey is a matched pair of cryptographic keys. One half is private and stays locked inside the device or password manager that created it. The other half is public, and it gets stored on the website's server. When you sign in, your device proves it holds the private key, and the server checks that proof against the public key it already has on file.

That's the whole mechanism. Nothing secret crosses the network, which means there's nothing for an attacker to intercept, guess, or scoop out of a database leak. The server keeps a public key that is useless on its own.

In practice it looks like this: you tap "Sign in with a passkey," your phone or laptop asks for Face ID, Touch ID, Windows Hello, or your device PIN, and you're in. No typing, no autofill dropdown, no forgotten which-email-did-I-use-here moment.

Why passwords keep failing

Password problems are rarely about picking a bad one. They're structural.

• Reuse. One leak at a forum you signed up to in 2013 becomes a working key for your email, because you used the same string.
• Phishing. A convincing login page collects your password and your one-time code in real time, and no amount of caution catches every attempt.
• Server breaches. Even a well-hashed password database becomes a target once it's large enough to be worth cracking.
• Recovery routes. Password resets run through email or SMS, which means your real weak point is often the inbox or phone number you barely think about.
• Memory limits. Humans are bad at holding dozens of unique, high-entropy strings, so we cheat, and cheating is what gets exploited.

A password is a secret you share with a server and hope it keeps. A passkey is a secret you never share at all.

The cryptography, minus the maths

When you register a passkey, your device generates that key pair and sends only the public half to the site. The private half is sealed in hardware or in an encrypted vault. From then on, the site never asks for a secret again.

At login, the server sends a fresh, random value — a challenge — that has never been used before. Your device signs it with the private key, and the server verifies the signature. Because the challenge is new every time, a recording of yesterday's login is worthless today. There is no code to replay.

Why the site name is baked in

Here's the part that does the heavy lifting against phishing. A passkey is bound to the exact domain it was created for. A passkey made for yourbank.com will not respond to yourbank-secure-login.net, no matter how polished the fake page looks. Your device checks the site's identity before it signs anything, so the credential simply refuses to participate.

That single property removes an entire category of attack that passwords and one-time codes have never solved. Codes can be relayed by an attacker in real time. Keys can't be talked into it.

Where passkeys live, and how they travel

There are two flavours, and it helps to know which one you're getting.

Synced passkeys live in a password manager or platform keychain — Apple's iCloud Keychain, Google Password Manager, a Microsoft account on recent Windows builds, or a third-party manager like 1Password or Bitwarden. They follow you across your devices and are encrypted end to end, so the provider can't read them.

Device-bound passkeys stay on one piece of hardware: a security key on your keyring, or a phone's secure chip. They don't roam, which is a feature if you want a credential that exists in exactly one physical place and nowhere else.

Signing in on something that isn't yours

You can use a passkey on a device that doesn't have it. The site shows a QR code, you scan it with your phone, and a Bluetooth proximity check confirms the two devices are actually near each other. It's how you sign into a smart TV or a borrowed laptop without typing anything. Slower than a tap, still faster than a password reset.

What passkeys don't fix

They're a significant step up, not a force field. Keep these limits in mind:

• Malware on your device can still ride an unlocked session, passkey or not.
• An unlocked phone in the wrong hands can approve a sign-in. Your device PIN matters more than it used to.
• Recovery is still the soft spot. Most sites fall back to email or SMS when you lose everything, so your inbox deserves the same protection.
• Support is uneven. Plenty of sites still offer no passkey option, so you'll be running a mix for a while.
• You can still be tricked into approving something, though the domain binding makes that far harder than handing over a password.

How to switch without breaking your week

Work in this order rather than converting everything at once:

1. Start with email. It's the reset hub for nearly everything else. Create a passkey for your main address first.
2. Then your password manager account, then banking, then online shopping. Those are the accounts where a takeover hurts most.
3. Add a second device or a synced manager before you rely on it. One passkey on one phone is a single point of failure. A synced keychain or a backup security key stored somewhere sensible fixes that.
4. Name each passkey clearly — "iPhone, personal" rather than "passkey 3." When you replace a device, you'll want to see which entries to revoke.
5. Keep the password and two-factor on as fallbacks until the site has a recovery method you trust. Most do keep a password option; leaving it in place is normal, not a failure.
6. Test it while you're calm. Sign out, sign back in with the passkey, and confirm it works before a deadline depends on it.

Finding the setting on the big platforms

Menu names shift between releases, so if you can't spot it, search the settings page for "passkey."

• Apple: passkeys are stored in the Passwords app on iPhone and iPad, and in Passwords under System Settings on the Mac. Sites offer them directly at sign-in.
• Google: Google Account settings, then Security, then the sign-in methods section, where you can add a passkey.
• Microsoft: Microsoft account security settings, under advanced sign-in options, where you can add a new way to sign in.

Do one account this week

Pick your email account and add a passkey tonight. It takes a couple of minutes, and it's the account whose compromise would hurt the most, which makes it the best place to see the technology work. Then add a second passkey somewhere else so you're not stranded if one device dies.

Leave the passwords in place on sites that don't support passkeys yet. Roll the rest over as support arrives, one account at a time, starting with whatever holds your money or your identity. In a year or two, the login box you type into will feel like a fax machine: functional, familiar, and something you're glad most places stopped asking for.

Photo: niekverlaan / Pixabay