Passwords remain the most common way into business systems for attackers, through phishing, reuse and credential stuffing. Passkeys remove the password altogether. They are supported by Apple, Google and Microsoft platforms and all major browsers, and users now see them offered by large consumer services every day, which makes them realistic for business applications too.
How do passkeys work?
A passkey is a pair of cryptographic keys created by the user’s device for one specific website or app. The public key is stored by your application; the private key never leaves the user’s device or password manager. To sign in, the user unlocks the passkey with a fingerprint, face scan or device PIN, and the device signs a challenge from your server. The underlying standards are FIDO2 and WebAuthn.
Why passkeys resist phishing
A passkey is bound to the domain that created it. A fake login page on a lookalike domain cannot request it, so there is nothing for an attacker to trick the user into handing over. There is also no shared secret stored on your servers that could leak in a breach; a stolen public key cannot be used to sign in.
Synced versus device-bound passkeys
- Synced passkeys are backed up and shared across a user’s devices through services such as iCloud Keychain, Google Password Manager or third-party password managers. They are convenient and solve the lost-phone problem.
- Device-bound passkeys live on one device, typically a hardware security key. They suit administrators and high-risk roles where you want to know exactly where the credential is.
What to plan before rollout
- Account recovery: the weakest part of any login system. Decide how a user who loses access proves who they are, without falling back to an easily phished method.
- Enrolment: offer to create a passkey right after a successful sign-in, when users are already verified.
- Autofill sign-in: use conditional mediation so passkeys appear in the browser’s autofill suggestions alongside saved passwords.
- Single sign-on: for workforce apps, passkeys are often best enforced in your identity provider, so every connected application benefits at once.
- Fallback: keep another strong method during transition, and phase out SMS codes for privileged users.
A sensible rollout
Start with administrators and staff with access to sensitive data, then offer passkeys to all users as an option, then make them the default for new accounts. Track sign-in success rates and support tickets at each step. Most teams find that users who try passkeys prefer them, because signing in becomes a single touch.
