Passwords have been failing for years, and everyone has adapted rather than fixed them: complexity rules people work around, reuse across dozens of sites, and a shared spreadsheet somewhere that nobody admits to. Passkeys are the industry’s attempt to remove the password rather than patch it, and support is now built into Windows, macOS, iOS, and Android.
What a passkey actually is
When you create a passkey, your device generates a matched pair of cryptographic keys. The private key never leaves your device and is protected by whatever already unlocks it — fingerprint, face, or PIN. The public half goes to the website.
Signing in means the site issues a challenge that only the private key can answer. Your device does the answering after you authenticate locally.
The consequence is the interesting part: there is no shared secret. Nothing is typed that could be watched, nothing is stored on the site that could be stolen in a breach, and nothing can be handed over to a convincing fake page.
Why this beats a password plus a code
Multi-factor authentication was a real improvement and attackers adapted. A fake login page can collect the password and the one-time code and use both within seconds. Push-approval fatigue — sending prompts until someone taps accept — works often enough to be a standard technique.
Passkeys close both. A passkey is bound to the legitimate site, so a lookalike domain cannot trigger it. There is no code to relay and no prompt to approve out of exhaustion. Phishing, as a way to steal that login, simply stops working.
The practical questions
What if I lose the device? Passkeys sync through your platform account — Microsoft, Apple, or Google — or through a password manager, so a new device restores them. For business accounts, register a second device or a hardware key rather than relying on one.
Do I need one per site? Yes, and that is the point: each is unique and useless anywhere else, so nothing carries across.
Does everything support them? Not yet. Microsoft 365, Google, Apple, and most major platforms do; plenty of smaller business applications do not. Passwords will stick around in the tail for a while.
Can we use them across a mixed estate? Increasingly, yes — syncing across platforms has improved considerably, and a password manager that supports passkeys smooths over the rest.
Where to start
Not everywhere at once. The sensible sequence is to enable passkeys on the accounts that would hurt most if stolen — Microsoft 365 or Google Workspace first, since email is the reset path for everything else — then banking and finance systems, then whatever else supports it as you go.
Keep multi-factor authentication switched on during the transition, register a backup method on every account that matters, and tell your team what is happening so the change reads as an improvement rather than an obstacle.
If you want a hand planning that across the business, it fits naturally into our security work and the identity side of managed support. Talk to us when you are ready.