Ready to bolster your defenses
Uncover how we can help put your resilience to the test.
This site uses cookies to enhance your browsing experience and analyze site usage. By continuing, you agree to our use of cookies. Read our Privacy Policy
For so long now, THE password has been the front door to the internet, applicationsand services.However, it’s also one of the weakest links we have.
For solong now, THE password has been the front door to the internet, applicationsand services.However, it’s also one of the weakest links we have.
We reusethem.
We forgetthem.
We write them down.
We useterrible ones.
We givethem away to convincing phishing sites. And when one organization is breached,stolen credentials which are reused for other accounts and services can becomethe key to dozens of other accounts.
Enter thepasskey.
Passkeysare increasingly being positioned as the successor to passwords: a way toauthenticate without typing a secret that can be stolen, guessed, replayed orphished. Major technology companies—including Apple, Google and Microsoft—nowsupport them, while hundreds of online services have begun adopting thetechnology. The FIDO Alliance describes passkeys as FIDO credentials based onpublic-key cryptography, designed to provide phishing-resistant authentication.
But whatexactly is a passkey—and if passwords are going away, what are attackers goingto target instead?
What exactly is a passkey?
It isessentially cryptographic credential that allows your device to proveyour identity to a website without sending the website a password.
When youcreate one, your device generates a cryptographic key pair:
Thewebsite doesn't receive your private key.
When youlater log in, the website sends your device a cryptographic challenge. Yourdevice uses the private key to sign that challenge, and the website verifiesthe signature using the public key it already has.
Theresult is authentication without transmitting a reusable password.
Think ofit less like sharing a secret with a website and more like showing it a keythat can prove it belongs to you—without handing over the key itself.
And thereis another important distinction: your fingerprint or face isn't thepasskey.
Yourbiometric is simply the mechanism used to unlock the credential on your device.The biometric itself generally stays on the device and isn't sent to thewebsite.
How to?
Theexperience is deliberately simple.
Imagineyou are signing into a website that supports passkeys.
Insteadof entering what we have all done a thousand times before:
Username
Password
MFA code
you mightsimply select "Sign in with a passkey."
Yourdevice asks you to authenticate using Face ID, a fingerprint, Windows Hello, aPIN or another device-unlock mechanism.
That'sit.
Thecryptographic authentication happens behind the scenes.
On acomputer, the passkey might be stored and protected through the operatingsystem. On a phone, it may live inside the platform's credential infrastructureor a password manager. You can also use another nearby device toauthenticate—for example, using a phone to sign into an account on a laptopthrough a QR-code-based cross-device flow.
Why are passkeys considered more secure?
Thebiggest advantage is simple:
There isno password for the attacker to steal or one for you to forget.
Traditionalpasswords create several opportunities for attackers:
Phishing:
A victim types their password into a fake website.
Credentialstuffing:
An attacker obtains credentials from one breach and tries the sameusername/password combination elsewhere.
Passworddatabase theft:
An attacker compromises a company's authentication database.
Passwordreuse:
One compromised password unlocks multiple accounts.
Passkeysdramatically change those equations.
Becausethe credential is cryptographically tied to the legitimate website's domain, apasskey created for example.com cannot simply be handed over to evil-example.com. The browser and operating system verify the origin before allowing thecredential to be used.
Thatmakes traditional phishing substantially harder.
A fakelogin page can ask you for your password.
It caneven ask you for your MFA code.
But itcannot simply ask your device something like, "Hey, give me yourprivate cryptographic key."
Thedevice should refuse because the request isn't coming from the legitimate site.
What happens if a website gets hacked?
This isanother major advantage.
Atraditional authentication database might contain password hashes. Depending onthe implementation and circumstances, attackers can potentially crack orotherwise exploit stolen credentials.
Withpasskeys, the website stores the public key, not the private key.
Thepublic key is not a secret.
Even ifan attacker steals the website's authentication database, they don't suddenlypossess the private key required to authenticate as you.
Thisdoesn't make a compromised website harmless. Attackers could still stealpersonal information, manipulate accounts through other vulnerabilities, attackaccount recovery systems, or exploit weaknesses in the application'simplementation.
But theauthentication database itself becomes a much less valuable target.
Where are passkeys protected on your computer?
This iswhere things get particularly interesting.
A passkeyisn't necessarily sitting in a file somewhere waiting to be copied.
Dependingon the platform and configuration, it can be protected by the device's securehardware, operating system security mechanisms, or a password manager.
Moderndevices can use hardware-backed security components to protect cryptographiccredentials. The user typically unlocks the credential through the device'sexisting authentication mechanism—such as a PIN, fingerprint or facialrecognition.
Forexample, Google Password Manager can synchronize passkeys using end-to-endencryption, while Apple's ecosystem uses iCloud Keychain to synchronizecredentials between supported devices. Microsoft supports passkeys throughWindows Hello and Microsoft Password Manager.
Whichbrings me to us to my next point.
Synced passkeys vs. device-bound passkeys
One ofthese things is not like the other: not all passkeys are the same.
Syncedpasskeys are designed to move between auser's devices. This is extremely convenient. Lose your phone and you don'tnecessarily lose access to every passkey you've created.
Thetradeoff is that the security of the synchronization and account-recoveryinfrastructure becomes part of the security model.
Device-boundpasskeys, by contrast, remain tied to aparticular device or hardware security key. They don't synchronize to thecloud.
That canprovide stronger protection for high-assurance environments—but it also createsa recovery problem.
Lose thedevice?
You maylose the credential.
The FIDOAlliance explicitly recognizes this security-versus-convenience tradeoffbetween synced and device-bound credentials.
Who uses passkeys?
Adoptionis growing rapidly.
Largetechnology and consumer services—including Google, Amazon, CVS Health,Nintendo, Intuit and Mercari—have implemented FIDO-based authenticationwith passkeys.
Microsoftsupports passkeys for Microsoft accounts, while Google provides passkey supportacross Android and Chrome. Apple supports passkeys through its device andcredential-management ecosystem.
Theimportant point is that passkeys aren't one company's proprietary technology.
They arebuilt around FIDO2 and WebAuthn, allowing browsers, operating systems,websites and password managers from different vendors to participate in thesame authentication ecosystem.
Can they be hacked?
This iswhere the conversation needs some nuance.
Passkeysare unfortuany not a magical unicorn that will solve all your problems.
They aredesigned to eliminate or dramatically reduce certain attack trolls—not everyattack.
The mostimportant thing to understand is that attackers are increasingly likely toattack the environment surrounding the passkey rather than the cryptographyitself.
1. Compromised devices
Ifmalware has significant control over your operating system or browser, thesecurity assumptions behind passkeys can be undermined.
A passkeymay be protected from theft, but an attacker controlling the device may be ableto manipulate what the user sees or what the browser is doing.
A 2025controversy around research dubbed "Passkeys Pwned" illustrated thisdistinction. The demonstrated attack relied on malicious browser software thatinterfered with passkey registration. Security analysis pointed out that thiswasn't the theft of an existing passkey; it was an attack on the registrationprocess and compromised client environment.
Thatdistinction matters enormously.
Breakingthe lock isn't the same thing as controlling the house while the owner installsa new lock.
2. Social engineering
Passkeyscan stop an attacker from stealing your password.
Theycannot necessarily stop an attacker from convincing you to do something risqué.
Anattacker might impersonate IT support and convince an employee to:
Thecryptography may be working perfectly.
The PERSONis the attack surface.
3. Account recovery
This maybecome one of the most important areas of passkey security.
Imaginean attacker can't steal your passkey.
So theydon't try.
Instead,they target:
"Forgotyour password?"
or
"Can'taccess your device?"
If anorganization maintains a weak recovery mechanism—such as poorly protected emailrecovery, SMS verification, help-desk resets or weak identity verification—theattacker may simply walk around the passkey rather than breaking it.
Thestrongest authentication technology in the world doesn't help much if therecovery process is dramatically weaker.
4. Theft of the physical device
Ifsomeone steals an unlocked laptop or phone, the situation changes.
Passkeysrely heavily on the security of the device protecting them.
Fortunately,a properly configured device generally requires the attacker to defeat thedevice's authentication mechanism as well.
This isone reason screen locks, device encryption, operating-system updates andhardware security protections remain important even in a passwordless world.
5. Passkey-provider compromise
Syncedpasskeys introduce another layer.
If yourpasskeys synchronize through a password manager or cloud ecosystem, thatprovider becomes an important component of the overall security architecture.
Modernsystems use encryption and additional protections to prevent the provideritself from simply using your passkeys to impersonate you. Google, for example,says its synchronized passkeys are end-to-end encrypted and that Google cannotuse them to impersonate users.
Butattackers can still target the surrounding ecosystem: account takeover, deviceenrollment, recovery mechanisms, phishing of the cloud account, malware andsession theft.
Andrecent attacks against password-manager ecosystems demonstrate why deviceenrollment and recovery mechanisms deserve as much attention as the credentialsthemselves.
There issometimes confusion around whether passkeys are "MFA."
In manyimplementations, the passkey combines:
Somethingyou have:
Your device or authenticator containing the credential.
Somethingyou know or are:
A PIN, fingerprint, face recognition or other local unlock mechanism.
Microsoftdescribes passkeys as a form of multi-factor authentication because thecredential and the local user-verification mechanism are combined into theauthentication experience.
Moreimportantly, passkeys can eliminate the need for many traditional secondfactors such as SMS one-time passwords.
Andthat's significant because SMS-based MFA can itself be attacked throughphishing, SIM swapping and social engineering.
Shifting gears
The realsignificance of passkeys isn't that they make logging in easier.
It's thatthey change the economics of attacking identities.
Foryears, attackers have built enormous businesses around stealing credentials.And it looks a little like this.
1. Phish the password.
2. Put their hand in the cookie jar.
3. Crack the hash.
4. Buy credentials on criminal marketplaces.
5. Try the credentials somewhere else.
6. Passkeys attack the foundation of that model.
7. There is no password to reuse.
8. There is no secret to type into a phishing page.
9. There is no private key sitting on the company'sserver waiting to be stolen.
10. And every credential is cryptographically tied toits intended service.
But thatdoesn't mean attackers disappear.
Theymove.
Thebattleground shifts from:
"Howdo I steal the user's password?"
And nowthe questipns arelooking a little like this:
"Howdo I compromise the user's device?"
"Howdo I trick them into registering my credential?"
"Howdo I compromise account recovery?"
"Howdo I hijack a session?"
"Howdo I compromise the identity provider?"
"Howdo I convince the help desk that I'm the victim?"
That isperhaps the most important thing organizations need to understand about thepasswordless future.
The password may be dying. Identity attacks aren't.
Passkeysrepresent one of the biggest changes to consumer and enterprise authenticationin decades.
Theydon't make authentication invincible. They make one of the most successfulattack strategies—stealing reusable credentials—considerably harder.
Andthat's a major win.
Butcybersecurity has a predictable pattern: when one door becomes harder to breakthrough, attackers start looking for another.
Passkeysmay close the front door.
The nextfight will be over the windows, the back door, the spare key—and the personstanding inside the house.
Thefuture of authentication isn't necessarily about making secrets harder tosteal.
It'sabout eliminating the secret altogether.
And fordefenders, that may be one of the most important shifts in identity securitywe've seen since the password became the default way we proved who we were.
For anenterprise audience, I'd boil the security message down to this:
Passkeysdon't eliminate identity risk. They eliminate a particularly dangerous type ofidentity risk: the reusable secret.
Organizationsadopting them should therefore think beyond deployment and consider:
Becauseif an organization deploys a beautifully phishing-resistant authenticationmechanism and then leaves a weak "Forgot password?" processsitting beside it, the attacker doesn't need to defeat the passkey.
They justneed to go around it.
Uncover how we can help put your resilience to the test.
