Passwords are a common security issue. Reusing them across accounts and old ones getting breached in data leaks means it’s time to consider beefing up your account security.
If you’ve seen a prompt to create a passkey and wondered what it’s all about, we’re here to explain passkeys versus passwords. The short answer is that passkeys provide increased security and are more convenient to use.
Passkeys versus passwords
Passwords are a way to convey that you know a piece of information that’s stored alongside your online account to give you access to it.
The account server you use stores the password, or a hashed version of it, which means every password you create is potentially vulnerable to website breaches.
If a password that you reused on more than one website is breached, all of those other accounts are potentially compromised.
Passkeys work differently; your device generates a matching pair of keys, keeps a private one to itself and hands the public key to the website.
That means each website gets a different key, and only one part of the key is shared.
When you sign in with a passkey, the website sends your device a randomised challenge string.
Your device produces a response derived from the private key, sends it back to the site and it’s checked against the public key.
The verification proves that your device holds the private key without it ever being shared.
It also means you don’t have to type anything into a dialogue box or remember a username or password yourself.
Passkey security benefits
Passkeys are much more resilient to phishing attacks than regular passwords. Passkeys for legitimate accounts simply won’t authenticate on lookalike domains the way passwords do.
There’s also no meaningful data stored on websites, meaning reduced value in server-side breaches, since the private key never leaves your device.
Lastly, since there’s no 6-digit code being sent, SIM spoofing attacks where a hacker receives your SMS 2FA code don’t apply.
Passkeys often use biometric authentication like fingerprint or face scan to verify it’s the owner using the device to log in.
The industry is increasingly moving in this direction. Microsoft is set to retire SMS and voice authentication for Entra ID business accounts, pushing these users onto the more secure passkey option.
Where passkeys fall short
The system offers big benefits over passwords, but it’s not flawless.
A major issue is about account recovery and how websites perform it. Some websites haven’t removed passwords as a sign in option, meaning the password still sits in their database and functions as a login method.
The security benefits passkeys offer simply don’t apply if a password is still a viable login option; though it does widen your options and means you don’t necessarily need a memorable password.
Another common objection is about what happens if you lose your passkey device.
It’s a fair question, but it’s often treated as a bigger issue than it actually is; recovery options work the same way as usual with email verification, backup codes, or another registered device.
A friction point can be moving keys between devices or ecosystems; say from an iPhone to Android. Many companies are vying to be the option you use for sign in.
Some password managers like Bitwarden allow you to store passkeys in the vault, making them great options for cross-platform security.
Should you switch to passkeys?
Yes – passkeys are a more secure and convenient sign in method for accounts that support them.
You don’t have to treat this as an immediate necessity and hunt down every single account in one sitting, but saying yes the next time a platform asks to create one is a good idea.
Think about where you’d like to store passkeys first, because switching passkeys between Apple, Google, and Microsoft platforms can be tricky.
Bitwarden is a free, open source option that provides good cross-platform operability, and it’s my password manager of choice. It’s a one-stop option for boosting your account security.
We haven’t yet said farewell to passwords forever, but each account you move off them is one less password that can be used against you.
To follow us for more guides, consider signing up for our newsletter.
8 comments
Wayne Marshall
Could I please go onto your email list
Scott Hunt
G’day Wayne, you can subscribe to our newsletter here: https://cybershack.com.au/subscribe/
Frank Siemensma
Good article Scott, but how about including “How to set up a Passkey ” so that novices like me can be sure how to do it!
Eric
OK, so now I know passkeys are the way to go to improve security. I think I understand the back-end, where the website gets half the key and my device keeps the other half.
But what is a passkey? I’m guessing a sequence of letters or numbers, but how and when are they created? Do I have to choose yet another code (just like a password) or does the system do it for me? Do I enter the passkey in the old password dialogue box? So many questions to be answered.
“I think we’re going to need a bigger explanation!” (with apologies to Jaws)
Scott Hunt
Hey Eric, a passkey is two long numerical strings. The first string is your private key, and the second string is the public key. The idea is that it’s impossible to figure out what the private key is from the public one.
Both are automatically generated when you choose to create them. In a practical sense, when you sign in with a passkey you simply approve the login, no need to enter anything into a login box.
kay lloyd
I hate to say this but I STILL don’t know what a passkey is!
Scott Hunt
Hey Kay, think of it like another way to log in to your online accounts instead of a username and password.
Larry Oliver
Great article. At last I understand what passkeys are all about and will definatley make the switch.