What’s More Secure Than a Password? A Passkey

How passkeys confirm your identity and device access to keep you safe

If you’re like most people, you have dozens or even hundreds of online accounts that require log-in access. Juggling all of those passwords can be a cumbersome task, which is why some people wisely turn to digital storage tools such as password managers. Others, however, engage in the risky practice of using too-simple passwords or repeating the same one across multiple accounts.

Should you fall into the latter group, you could be asking for trouble. Fraudsters who grab your password in a data breach or phishing campaign will often try using that same password to break into other accounts of yours.

What if there was a faster and safer way to access your accounts? A growing number of organizations and consumers are turning to passkeys—a technology that uses advanced encryption methods to help keep online accounts secure—as the answer. Major tech platforms and companies including Amazon, Apple, eBay, Google, Meta, and Microsoft now offer passkey support across a full range of products and services.

What are passkeys and how do they work?

The Identity Theft Resource Center (ITRC) defines a passkey as “a digital credential (typically a face scan, fingerprint, or PIN) that allows users to sign in to a website or app without entering a password or username.” The National Cybersecurity Alliance (NCA) adds that when you create a passkey, your device generates a pair of digital keys: “a public key, which is stored by the website or app, and a private key, which stays securely on your device.” When logging in, those two keys get matched: The website or app verifies that you have access to your device, while your device verifies the authenticity of the website or app.

Both the ITRC and the NCA identify several advantages of passkeys over passwords, including:

• If you get tricked into visiting a fraudulent website, scammers won’t be able to steal your log-in password, because you’re not using one.
• If you unwittingly visit a phony website that’s designed to mimic a real organization’s site, you’ll be safely prevented from logging in. (The fake site won’t have access to the real site’s unique passkey associated with your account, so the log-in attempt will fail.)
• Your private key is a unique identifier that remains securely stored on your physical device, not in the cloud, meaning it can’t be stolen in a data breach.
• Should your device get stolen or lost, no one else can unlock it without having your fingerprint, face scan, or device PIN.
• Passkeys serve as their own form of multifactor authentication, since they confirm your identity through your fingerprint or face scan and prove that you have possession of your unlocked device.

How to set up passkeys

Getting started with a passkey is simple:

• Find out which of your online accounts support the use of passkeys, then log into the website or app as you normally would.
• Within your account settings, select the option to create or save a passkey.
• Choose to verify your identity using a form of biometric authentication such as your fingerprint or face scan. (Note that your biometric data stays on your device and is not stored on the app or website.)
• As an alternative to biometrics, you can verify using a device PIN, although most experts agree that this method is generally not as secure.

Once your passkey is set up, you never again need to enter a password to log in. A single passkey can make access easier by syncing across any of your devices that work on the same operating system. For example, if you have an iPhone, the passkey can sync with other Apple devices like an iPad or Mac laptop as long as those devices are signed in to the same iCloud account. Similarly, a single Google passkey can sync across Android and Chrome.

Are we on the verge of a password-free future?

While passkeys have proven to be far more secure than passwords, the truth is that they’re not entirely invulnerable—it’s doubtful that any online-access technology will ever be. Bad actors are continually seeking new ways to game the passkey system and hijack people’s accounts using malware and other methods.

And in terms of availability, not all devices and tech platforms currently support the use of passkeys. This means that passwords and multifactor authentication won’t be going away any time soon. But if you want to begin stepping up your digital safety right now, you can do so by taking advantage of passkeys wherever they’re offered.