Passkeys: A Simpler, Safer Way to Sign In

Passwords remain the standard way to sign in online, but we’ve all experienced their shortcomings: using easy-to-remember passwords; trying to remember where you saved a complex password; storing passwords in risky spreadsheets; or hunting through old paper notes only to find a previous password (which surely was changed the last time this exact thing happened). IT security leaders have long advocated for using password-management apps to help rein in “credential sprawl.”

A passkey is a newer sign-in/authentication method that makes secure logins easier while better protecting your credentials from scammers and spoofers. Passkeys are stored in “vaults,” which could be the password managers built into your devices and browsers, or third-party password managers like Bitwarden, LastPass, and Dashlane.

Passkeys are about to become much more prevalent. Microsoft is moving toward requiring passkeys for some users as it phases out certain older MFA methods, and other service providers are surely keeping close watch on the progress of that rollout.

What Is a Passkey?

Security advice has long been predicated on a combination of two, if not three principles: something you know, something you have or bring, and something you are. A username and password or PIN is something you know; a text message or code from an app can provide evidence of something you have; your fingerprint or face verifies who you are.

A passkey combines some of those checks into a simpler action. Your phone, computer, security key, or other passkey provider is the thing you have. You unlock that device or provider with a PIN you know, or with the fingerprint or face that you are. The passkey itself uses a pair of cryptographic keys to prove to the website that you are authorized to sign in, without sending the website a password that could be stolen.

In practice, when you reach a passkey-enabled website you don’t even type a password into the webpage. Once you enter your login ID, the site checks your account and finds an available passkey. You’re prompted to access or use your passkey, and your PIN, fingerprint, or face may be used to unlock the vault. Your vault then uses the passkey to authenticate you to the website. The website can verify that response using the corresponding public key that it already has associated with your account’s passkey.

Why Are Passkeys Safer?

A password can be guessed, exposed in a company breach, or stolen through a convincing phishing email or fake website. If you tend to reuse passwords, one leak may cause trouble in several places.

To combat these security flaws, the world turned to multi-factor authentication (MFA), including two-factor authentication (2FA), SMS and text messages, authenticator-app codes such as TOTP, and other methods. For more on rotating codes, see my article, “Understanding MFA, 2FA and TOTP.”

Adopting MFA is much more secure than using a password alone, but many traditional MFA methods can still be phished. A criminal may be able to intercept a text message, steal a session, or trick someone into entering credentials and authentication codes on a fake site.

Passkeys help cover those vulnerabilities. A passkey is cryptographically tied to the specific website for which it was created. If you reach a fake version of a bank or shopping site, passkey authentication generally will not work there because the passkey was created specifically for the legitimate website. The fake website can’t simply ask for, copy, or reuse the passkey. That makes look-alike website scams far less useful to criminals, and you can’t tell a passkey to a scammer over the phone.

From an IT security perspective, passkeys help mitigate a pressing need by leveraging tools already in users’ hands. From an IT support perspective, it’s not quite so simple. Passkeys are so easy to adopt that users can unintentionally create a new form of “credential sprawl” by saving passkeys in different password managers or passkey providers (i.e., vaults) without realizing where those credentials are being stored.

Choose One Home

…or at least understand where your passkeys are being saved.

Passkeys can be stored in several different places. When a site asks where to save a passkey, don’t blindly accept the default suggested location. For simplicity, pick one trusted, primary home and use it consistently as the vault in which you save your passkeys.

Your vault might be Apple Passwords/iCloud Keychain because you visited a website in Safari on your iPhone, followed the prompts, and saved the passkey as suggested. Your vault might be Google Password Manager, or a third-party password manager such as Bitwarden. In fact, you might already be using multiple passkey providers, perhaps without even realizing it.

Spreading passkeys around multiple vaults is not inherently unsafe, but it can be inconvenient and confusing. You may not know which vault holds a particular passkey, or you may find that a needed passkey isn't available on the device in front of you. In that situation, you might bypass the passkey by using another available authentication method. You may then be prompted to set up another passkey, potentially making the situation even more confusing the next time you log in from a different device.

Think of your passkey vaults like keyrings: it’s a lot easier to find the key you need when most of your keys are on one dependable keyring. Extra taps or clicks needed for accessing your preferred vault can often be preempted by making some up-front changes in your devices’ default settings.

Most passkey-enabled websites allow an account to have multiple passkeys, which can actually be useful. For most people, I recommend choosing one primary vault. More sophisticated users may intentionally maintain passkeys in more than one trusted provider or on more than one device as a backup. The important thing is to understand where those passkeys are being stored and to manage them intentionally.

Plan for Portability

Portability means the vault offers the ability to securely move your data if you decide to switch vault products. Choose a vault that automatically synchronizes between your devices, or at a minimum supports secure transfer of everything saved within it.

Passkey transfer standards are still developing, and compatibility between your old and new vaults might not yet be available. Plain-text backups can facilitate changing vaults but be warned that an exported vault is an extremely sensitive file. It’s like a ring full of house keys, each of which has the house’s address and alarm code stamped on it!

Use vault exports only as a carefully protected backup, or when moving between providers. Never email the contents of your vault to yourself (or to anyone)! Never store the file in a shared folder or accidentally leave the exported file behind on someone else’s computer.

Cautionary Caveats

When you create an account or enable passkeys, some services provide recovery codes. Save these recovery codes securely, especially the recovery codes for your main email account and for the email account you think of as “just a recovery account.” Don’t save recovery codes someplace like Dropbox or OneDrive if access to those services depends on the very account or credentials you are trying to protect.

Use of passkeys is not infallible! If you lose or upgrade the device which contains your vault, you could potentially be locked out of websites and services. Synchronizing your passkeys across devices makes them more conveniently accessible and greatly reduces the stress of getting a new device.

If you’ve got a good handle on passkeys and vaults, maintaining multiple passkey providers or backup authenticators can also help you regain access if you lose access to your primary one. The key is understanding exactly what is stored where and how each service handles recovery.

It’s All (in) My Vault

My current vault slash password-management app of choice is Bitwarden, which stores passwords, MFA codes, passkeys, credit-card information, and a bunch of other info I want easily accessible and still protected. As an IT professional, my needs from Bitwarden require a paid license, but Bitwarden’s free tier can meet most people’s needs for saving their own credentials and authentication tokens (but please let me know if your needs are more advanced).

The transition to passkeys met a critical security need affecting every digital citizen. Unfortunately, passkeys were essentially forced upon users without clear explanation or instruction. Passkeys are easy for the user to create and use, even completely unintentionally. Despite insufficient explanation and guidance, passkeys gained widespread acceptance to the point of becoming a mandatory part of your secure login process.

Whichever vault you choose, it should #streamline your daily workflow rather than complicate it. And whichever you choose will surely be easier to use than the scattered sticky notes that fell off the corner of your monitor!