Strong passwords are still useful, but in practice, many people continue to use the same password across multiple services, store them in easily guessable places, or enter them on fake login pages. This is where passkeys offer a different approach: instead of making passwords more complicated, they reduce the need to use passwords altogether.
A passkey is a digital credential stored on a device, such as a smartphone or computer, and is used by unlocking the device—such as through a fingerprint, facial recognition, PIN, or pattern. Technically, passkeys use a pair of cryptographic keys, so services do not need to store passwords that can be stolen in plain text. ([fidoalliance.org](https://fidoalliance.org/passkeys/?utm_source=openai))
Why are passkeys harder to phish from fake sites?
Phishing typically works by tricking victims into entering their username, password, or verification code on a seemingly legitimate site. Scammers then use that information to take over accounts.
Passkeys operate on a different principle. Their credentials are tied to the correct service or website address. If someone opens a fake login page, the device should not provide the passkey for that service. In other words, users do not need to remember whether the page truly belongs to their bank, marketplace, or email provider—the device helps verify the login context. The FIDO design is indeed intended to make authentication resistant to phishing. ([fidoalliance.org](https://fidoalliance.org/implement-passkeys-overview/?utm_source=openai))
This does not mean that passkeys eliminate all forms of fraud. Scammers can still contact victims, impersonate service agents, or persuade victims to add new devices to their accounts. Passkeys protect the authentication process but do not replace vigilance against social engineering.
Passkeys are not just “logging in with a fingerprint”
Fingerprints or facial recognition only serve to unlock the passkey on the device. That biometric data is typically processed locally by the device and is not sent to the site as a password. What is sent to the service is cryptographic proof that the device possesses valid credentials.
Therefore, passkeys are not the same as storing a password and filling it in automatically. Password managers manage secrets in the form of passwords, while passkeys use public and private key mechanisms. This distinction is important because the private key is not shared with the site during the login process.
Two things to understand before enabling them
1. Passkeys can be synchronized or tied to a single device
Some passkeys are synchronized through the credential manager of the operating system or third-party providers. The benefits are clear: when replacing a phone, passkeys can be available again on the new device after the main account is restored. FIDO explains that synchronized passkeys are protected with end-to-end encryption by the credential provider. ([fidoalliance.org](https://fidoalliance.org/passkeys/?utm_source=openai))
On the other hand, some passkeys are only tied to a single device or a physical security key. This model can provide tighter control, but the consequences are more significant if the device is lost or damaged. For everyday use, synchronized passkeys are usually more practical. For high-value accounts, a physical security key can be a sensible additional layer.
2. Account recovery remains very important
Account security often weakens not during the login process, but during recovery. For example, someone loses their phone and then uses a backup email with the same password as another account, or follows recovery instructions from a WhatsApp number claiming to be an official service.
Before enabling passkeys, ensure that your primary email, recovery number, and connected devices are still fully under your control. Also, check the list of active sessions and devices that have logged in. If the service provides a recovery code, store it offline in a secure place—not as a screenshot in your phone's gallery.
What does this mean for us?
Passkeys are most useful for accounts that serve as a “key” to other services. Examples include your primary email, Apple or Google accounts, cloud storage, marketplace accounts, and banking services that support them. If your primary email is compromised, scammers can often request a password reset for other accounts.
CISA recommends phishing-resistant authentication methods like FIDO or WebAuthn as stronger options compared to methods that can still be phished, including SMS. However, CISA also emphasizes that any authentication is still better than having no protection at all. ([cisa.gov](https://www.cisa.gov/more-password?utm_source=openai))
So, there’s no need to wait for all services to support passkeys. Start with your most important accounts and use the best security methods available. If passkeys are not yet available, use an authenticator app as a generally better option than SMS codes, and ensure your passwords are unique.
What you can do now
- Secure your primary email account first. Enable passkeys if available, then check active devices and login sessions.
- Use a strong lock screen. Passkeys still rely on device security. Avoid easily guessable PINs like birthdays or 123456.
- Enable automatic updates. Updated operating systems and browsers help fix security vulnerabilities.
- Set up recovery methods. Ensure backup email, phone number, and recovery codes are not controlled by others.
- Do not approve login requests that you did not initiate. If a notification appears to add a passkey or new device without a clear reason, cancel it and check your account through the official app or site.
- Remove access from old devices. When selling or replacing a phone, remove your account from the old device and delete credentials that are no longer needed.
Limitations to keep in mind
Passkeys do not protect devices that are already unlocked and loaned to others. They also do not prevent someone from tricking you into providing recovery access, installing malicious apps, or consciously approving transactions.
Think of passkeys as a house key that is harder to duplicate, not as a guard that can make all decisions. That key still needs to be kept on a secure device, the recovery door must be checked, and any suspicious access requests should be halted.
For most people, the best step is not to immediately replace the entire security system. Choose one important account, enable a passkey, check its recovery method, and then get used to using that method. Gradually, reliance on repeated passwords and easily phished verification codes can be reduced.
Sources & further reading
- FIDO Passkeys: Passwordless Authentication
- Passkey Implementation Overview
- More than a Password
- Mobile Communications Best Practice Guidance
– Rio Yotto @rioyotto