Passkeys are here to replace passwords. When they work, it’s a seamless vision of the future. But don’t ditch your old logins just yet.
For two years, my Netflix password has been: tricke22ry-notiLonal-freely-soSak-lice-slacken. Yes, really. It is a strong, unique password, and it ticked boxes for reducing the chances of me getting hacked. But for all its security protections, the password was a nightmare to type into an onscreen TV keyboard, and it constantly annoyed members of my family who shared my Netflix login. It’s just the tip of my password suffering, though.
I use a password manager to generate and store all the login details for the 337 accounts I’ve made—from pizza delivery and airlines to social media and online shopping—over more than a decade online. However, using a password manager compulsively and having hundreds of strong passwords likely puts me in the minority: Many people use the same password across multiple accounts or use passwords that can easily be guessed.
However, there are a few things that caused me problems setting up passkeys—my first attempt was disastrous. In that case, my work laptop wasn’t running an operating system that supports passkeys. While waiting for it to update, the PayPal app kept glitching and wouldn’t let me complete the passkey process. Then I couldn’t create one specifically for TikTok as I used my work Google account to create the account. When I tried to set up a passkey for Amazon and needed to scan a QR code on my phone, I found that my password manager, Bitwarden, currently doesn’t support passkeys on mobile.
Using passkeys likely means having a different mindset from how you think about passwords. There’s nothing to remember when you log in, and you have to use something else to store your passkeys. Passkeys can be stored in Apple’s, Google’s or Microsoft’s password manager systems; your browser; a dedicated password manager; or on a physical security key. I created a Google passkey on one USB key, and all I need to do to sign in is, essentially, plug it in. (All of the devices I use professionally and personally are Apple, meaning I haven’t tested passkeys between my iPhone and a Windows laptop, for instance.)
“The technology is mature, the front ends are still nascent,” Shikiar from the FIDO Alliance says. Over the past year, the FIDO alliance has also been working on user experience guidelines, he says, making it more straightforward for people to sign up and use passkeys across systems. Gary Orenstein, the chief customer officer of password manager Bitwarden, says there are multiple groups involved in the creation and rollout of passkeys, so transitioning to a world where everything is seamless takes coordination. “The standards are at one level, user expectations are at a different level,” he says. “The vendor implementations are at a third level, and they’re merging, but it takes time.”
“They are a true password replacement that eliminate the threat of phishing, eliminate the hassle of password resets, and eliminate the liability that service providers have when they’re managing thousands, tens of thousands, or tens of millions, or billions of passwords,” Shikiar says. “It really is an entirely new way of doing user authentication.”
The way we use passwords has been broken for a long time, but that’s finally changing. Over the past year, it has become possible to ditch the password and move to passkeys instead. Passkeys are generated codes—created using public key cryptography—that are stored on your device or in your password manager and let you log in to websites and apps using your fingerprint, face recognition, or a PIN. They can’t be guessed, leaked, or stolen, and they stop phishing attacks in their tracks, according to those behind the technology. Passkeys are widely considered to be more secure than passwords.
Google, Apple, Microsoft, Amazon, GitHub, PayPal, the UK’s National Health Service, OnlyFans, Nintendo, and more than 100 websites have started supporting passkeys. More than 8 billion online accounts can set up passkeys right now, says Andrew Shikiar, the chief executive of the FIDO Alliance, an industry body that has developed the passkey over the past decade. So, I decided to kill my passwords.
For the past month, I’ve been converting as many of my accounts as possible—around a dozen for now—to use passkeys and start the move away from the password for good. Spoiler: When passkeys work seamlessly, it’s a glimpse of a more secure future for millions, if not billions, of people, and a reinvention of how we sign in to websites and services. But getting there for every account across the internet is still likely to prove a minefield and take some time.