Passkeys Explained: Why Passwords Are Being Replaced and How to Prepare

Passwords have been the weakest link in online security for decades. People reuse them, write them down and type them into fake login pages. Passkeys are the industry's answer. Apple, Google and Microsoft all support them, and more websites offer "Sign in with a passkey" every month.

What is a passkey?

A passkey is a login credential based on public-key cryptography, built on the FIDO2 and WebAuthn standards. When you create a passkey for a website:

1. Your device generates a key pair.
2. The public key is sent to the website and stored with your account.
3. The private key stays on your device or in your password manager, protected by your fingerprint, face or device PIN.

When you sign in, the website sends a challenge, your device signs it with the private key after you unlock it, and the website verifies the signature with the public key. No password is typed or sent.

Why passkeys stop phishing

This is the most important benefit. A passkey is tied to the exact website domain it was created for. If an attacker builds a fake login page on a look-alike domain, your device simply has no passkey for that domain, so there is nothing to steal or enter.

Passkeys also remove other common risks:

• No password reuse, because each site gets its own key pair.
• Nothing useful to leak in a server breach: websites only store public keys.
• No one-time codes to intercept or trick users into reading out.

What users experience

For users, signing in usually looks like this: choose "Sign in with passkey", confirm with a fingerprint, face scan or PIN, and you are in. Passkeys can sync across devices through the platform's password manager (for example iCloud Keychain or Google Password Manager), or users can sign in on a new computer by scanning a QR code with their phone.

Synced vs device-bound passkeys

Type	Where the key lives	Good for
Synced passkey	Encrypted in a cloud password manager	Consumers, convenience, recovery
Device-bound passkey	One device or hardware security key	High-security staff accounts, admins

Many organisations use synced passkeys for customers and security keys for administrators.

How businesses should prepare

For your own staff

• Enable passkeys or security keys for email, identity provider and admin accounts where your providers support them.
• Start with IT and finance teams, who are the most targeted.
• Keep a documented recovery process for lost devices.

For your customers

• Offer passkeys as an option alongside existing login, not as a forced switch on day one.
• Promote them after login: "Sign in faster next time with a passkey."
• Keep account recovery strong. If attackers can reset an account through weak email or SMS recovery, passkeys alone do not help.

For developers: how to add passkeys

Passkeys use the browser's WebAuthn API. In practice, most teams use a well-maintained library or their identity provider rather than implementing the protocol by hand.

The flow has two parts:

1. Registration: the server creates options (challenge, user id, relying party id), the browser calls navigator.credentials.create(), and the server verifies and stores the returned public key.
2. Authentication: the server sends a challenge, the browser calls navigator.credentials.get(), and the server verifies the signature against the stored public key.

Important details:

• The relying party id must match your domain.
• Store multiple passkeys per user, so people can register more than one device.
• Use conditional UI (autofill) so passkeys appear in the username field.
• Test on Windows, macOS, Android and iOS before launch.

Common questions

What if I lose my phone? Synced passkeys are restored when you sign in to your account on a new device. Device-bound keys need a backup key or a recovery process.

Are passkeys the same as two-factor authentication? A passkey combines something you have (the device) with something you are or know (biometric or PIN), so it already provides strong, multi-factor protection in one step.

Do websites see my fingerprint? No. Biometrics only unlock the key on your device and never leave it.

Frequently asked questions

Can passkeys be shared with family members or colleagues? Some password managers allow sharing passkeys within a family or team. For business accounts, it is better for each person to have their own account and passkey so access can be traced and removed.

Do passkeys work on older phones and computers? Most current versions of Windows, macOS, iOS and Android support them. On older devices, users can sign in by scanning a QR code with a phone that has the passkey, or keep a password as a fallback.

Should we remove passwords completely? Not on day one. Offer passkeys alongside passwords, encourage adoption, and consider removing passwords for staff accounts once everyone has registered passkeys or security keys.

Key takeaways

• Passkeys replace passwords with device-protected cryptographic keys.
• They are bound to the real website domain, which makes phishing ineffective.
• Start with staff and admin accounts, then offer passkeys to customers as an option.
• Developers should use proven WebAuthn libraries or identity providers and test across platforms.

KHR Digital Solutions builds secure login systems, including multi-factor authentication and modern identity integration, for business web and mobile applications.