Passkeys change what an attacker can steal.

I like passkeys for a pretty simple reason: they take away some of the easiest things an attacker can steal.

For years, we've asked people to come up with a good password, not reuse it, spot fake websites, ignore suspicious texts, and never tell anybody the one-time code they were just sent. Oh, and please remember all of that when you're tired, distracted, or trying to get something done quickly.

We can keep reminding people to be careful. I just don't think a security strategy should depend on everyone making the right call every single time.

Passkeys are interesting because they change the problem instead of adding another warning to the login screen.

What does an attacker usually try to steal?

A password is useful to an attacker because it's a secret they can copy. If they convince you to type it into a fake website, they now have something they can try against the real one.

An SMS or authenticator code makes that harder, but someone running a convincing phishing site can still ask you to enter the code. They may even relay it to the genuine site while you're sitting there, wondering why the login is taking so long.

Push notifications have their own problems. If you've ever had your phone repeatedly ask you to approve a sign-in you didn't start, you can see why.

With a passkey, you aren't handing over a password or a six-digit code. Your authenticator is producing a cryptographic response for the right service. Your face, fingerprint, or device PIN simply authorizes the passkey to do its job.

And if somebody calls and asks you to read them your fingerprint over the phone, I suspect that conversation will be over pretty quickly.

A fake login page can copy the look, not the domain

Picture one of those phishing pages that gets almost everything right. Same logo, same colours, probably a fairly believable address if you're not paying close attention.

With a password, the page just needs you to type. With a passkey, the browser and authenticator check which service is actually asking. A credential created for the genuine service isn't available to a lookalike site pretending to be it.

This is the bit that makes me optimistic about passkeys. Rather than telling people to get better at identifying fake websites, the technology checks the site for them.

It won't stop every scam or every form of account compromise, but phishing a reusable sign-in secret becomes a very different proposition.

What if someone steals the website's authentication database?

There's a second scenario I think is worth talking about, because it doesn't involve tricking the person signing in at all.

In a typical password system, the website stores a way to verify passwords, usually salted password hashes. Properly designed, those aren't plain-text passwords. But if that database is stolen, attackers may be able to try guesses against the hashes offline. Weak or reused passwords can become a real problem.

A site using passkeys stores public keys for those credentials. You can steal the public key, but you can't use it to sign in as its owner. You need the private key, which isn't sitting in the website's credential database.

I find that a pretty neat change. The website can verify that you're the right person without keeping a reusable secret that would let someone impersonate you.

Of course, a breached application can still expose all sorts of other information. And if the account also has a password or another weaker sign-in method, an attacker may go after that instead. I'm not suggesting the word passkey somehow fixes a compromised application.

It does mean one particular kind of stolen record is far less useful than it used to be.

Where does the passkey actually live?

You'll hear people talk about synced and device-bound passkeys. Both use the same basic cryptographic idea, but they make different trade-offs.

A synced passkey can be made available on your supported devices through a credential manager. If you change phones, that can make life much easier, assuming you can still get into your credential manager.

A device-bound passkey stays with one authenticator. That might be your computer or a physical security key. A USB security key can travel between computers, of course. It's the credential that stays on the key rather than being synced to other authenticators.

I wouldn't declare one universally better than the other. For many everyday accounts, synced passkeys offer a very sensible balance of security and convenience. For a privileged or higher-assurance use case, I may want more control over the authenticator and its recovery process.

The part I care about is understanding the choice. Where is the credential stored? What protects the account that syncs it? What happens when a device is lost? Can we tell whether the person actually verified themselves before the passkey was used?

Those details matter more than the marketing label.

I'd spend a lot of time on recovery

Imagine we give someone a phishing-resistant passkey, then allow them to recover their account by answering a few security questions or receiving a code over SMS.

An attacker doesn't have to defeat the passkey. They'll try the other door.

I don't think that means we should make recovery miserable for legitimate users. Quite the opposite. Good recovery needs to be both secure and practical, because people will lose phones, replace computers, and change how they manage their credentials.

Before calling a passkey rollout successful, I'd want to see what happens in those ordinary situations. Can someone use the same service on the web and in its mobile app without unnecessary re-enrolment? Can they sign in on a new computer using their phone? What does support do when they're locked out? Do the old password and SMS routes still exist?

I'd also keep watching for threats passkeys don't address. Stolen sessions, malicious software on a device, bad authorization decisions and weak recovery processes aren't going anywhere just because the login screen changed.

Why I think they're worth getting right

There are plenty of security improvements that ask people to do more work. Longer passwords. Another code. Another approval. Another reminder about phishing.

Passkeys are one of the rare ones that can ask people to do less while making some very common attacks a lot harder.

That's why I care about the details of the rollout. A good passkey experience should be easy to understand, consistent between devices, and backed by recovery that doesn't quietly undo the protection.

I don't need it to look futuristic. I need it to work on a normal Tuesday, when someone just wants to get into their account and get on with their day.