Passkeys 101: Why They’re Better Than Passwords

Passwords are a hassle for users and website admins alike. They are hard to remember, easy to steal, and often reused across sites. Fortunately, a more secure and streamlined alternative is gaining traction: passkeys. Here is what they are, how they work, and where you can start using them.

What Are Passkeys?

Traditional logins often use two of three verification types:

• Something you know (like a password)
• Something you have (a texted code or app)
• Something you are (a fingerprint or facial recognition)

But this still leaves room for phishing and credential theft. Passkeys change the game.

A passkey consists of a public key (stored by the website) and a private key (stored securely on your device). When logging in, your device proves it has the private key, usually via Face ID or Touch ID, without sharing the key itself. This makes it virtually impossible for someone to intercept or reuse your credentials.

How Are Passkeys More Secure?

Unlike passwords:

• They can’t be guessed or phished
• They require your physical presence
• They are tied to your device, not your memory

Instead of “something you know,” passkeys rely on:

• Possession – Do you have the device?
• Presence – Are you in front of it?

This approach dramatically reduces the risk of stolen logins, credential stuffing, or remote attacks.

Where Can You Use Passkeys?

You’ll use passkeys to log into websites and apps, and they’re stored in your password manager, just like passwords.

Apple users get seamless support in Safari (iOS 16/macOS Ventura and later) via the Passwords app.

Other options:

• 1Password, Bitwarden, Dashlane: cross-platform passkey support
• Google Chrome + Chromium browsers (Arc, Brave, Edge, Opera, Vivaldi): strong support
• Firefox: works well with third-party managers

Many major sites now support passkeys, including:

Apple, Google, Microsoft, Amazon, Netflix, PayPal, GitHub, Robinhood, Target, WhatsApp, and more.

How to Set Up a Passkey

Setup varies slightly by site. In most cases:

• You’ll be prompted to create a passkey during login
• Or, you can enable it manually in your account settings

Example: Google

Visit your Google security page →, click Create a Passkey → choose your preferred password manager. Done.

Tip: A passkey can only be saved in one manager (e.g., Apple Passwords or 1Password), but most sites allow you to create multiple passkeys across platforms.

Note that if you use both Passwords and another password manager, you can save the passkey in only one, and only that one can use it to sign in later. However, most sites that support passkeys let you add multiple passkeys, so you could save separate passkeys in different password managers.

How to Sign In Using a Passkey

Logging in with a passkey is simple:

1. Visit the website
2. Enter your username
3. Choose sign in with passkey
4. Authenticate using your device (Touch ID, Face ID, etc.)

A QR code will appear if you’re using a browser or device that doesn’t have the passkey stored. Scan it with your phone or tablet that does.

Exactly how you authenticate depends on the device you’re using and your password manager. On the Mac, Passwords will ask you to use Touch ID if available (above) or a dialog otherwise (below, left). 1Password, once unlocked for the session, presents a dialog with a Sign In button (below right).

An authentication dialog on the iPhone and iPad appears at the bottom of the screen asking if you want to sign in with your passkey. Tap Continue and authenticate with Face ID or Touch ID (with a fallback to your passcode if necessary).

Unsurprisingly, Apple makes it particularly easy to sign in to Apple websites like iCloud.com using a passkey. When you navigate to such a site in Safari, the device prompts you to sign in using your current Apple Account username and an implicit passkey.

Managing and Sharing Passkeys

Passkeys are stored in your password manager and sync across your devices (within the same ecosystem). You can’t see or edit them, but you can delete or recreate them if needed.

Do you want to share access with a family member or team member? Just log in on their device and create a separate passkey for them. This lets them prove possession and presence to log in securely.

Current Limitations of Passkeys

Passkeys are a big step forward, but they’re not perfect yet:

• Account recovery: No recovery if you lose all devices and didn’t set up a backup
• Sharing friction: Requires creating a new passkey on each user’s device
• No cross-platform export/import
• Inconsistent user experience across websites
• Passwords still exist: Most sites haven’t gone fully passwordless
• Digital inheritance: No standards yet for passing access to loved ones

Passkeys are not a silver bullet, but they’re a significant improvement. They’re easier to use, more secure, and available across most major platforms. By using passkeys now, you’re moving toward a more secure and streamlined login experience.

(Featured image by iStock.com/tanit boonruen)

Need Help?  Contact us to learn how we can help your business.