Passkeys: what they are and why they are replacing passwords
Google, Apple, Microsoft, Amazon and PayPal already support them. Passkeys get rid of passwords and make phishing almost impossible. Here is how they work and how to turn them on.
- Level
- beginner
- Time
- 5 minutes
- What you need
- Nothing, just curiosity
Passwords have a fundamental flaw: to work they must be secret, but to use them you have to write them down somewhere, and anything you write down can be stolen, guessed or captured by a fake website. Passkeys were created to solve the problem at its root, and within a few years they have gone from experiment to a standard adopted by the major online services.
How they work
A passkey is a pair of cryptographic keys created by your device when you sign up to a site. The private key stays on your phone or computer, protected by the operating system, and never leaves the device. Only the public key is sent to the site. When you log in, the site sends a “challenge” and your device signs it with the private key, after asking for your fingerprint, face or unlock PIN.
The practical result: nothing to remember, nothing to type, and nothing a criminal can intercept. A phishing site imitating your bank receives no password at all, because the passkey only works on the exact domain it was created for.
Where they are already available
Google, Apple, Microsoft, Amazon, PayPal, eBay, GitHub, WhatsApp and many others already let you sign in with passkeys, and banks are adopting them across Europe. Passkeys sync between devices through iCloud Keychain, Google Password Manager or password managers such as 1Password and Bitwarden, so you are not locked out when you change phone.
How to turn them on
Go to your account’s security settings (usually under “Sign-in” or “Password and security”), look for “Passkeys” and follow the steps: the device will ask for a biometric confirmation and the passkey is ready. We recommend keeping the password as a backup method until you are sure the passkey is on at least two devices.
What changes for security
Passkeys neutralise the two most common attacks: phishing and the reuse of passwords stolen from other sites. Locking the device with a strong code and backing up the cloud account that syncs the keys remain important. If your favourite service offers them, turning them on is probably the single easiest security upgrade you can make today.