Everything to Know About Passkeys for a Password-Free Future

1Password has a list of sites, alongside those of Best Buy and Kayak, that have added passkey support. If you want to check out how passkeys work without messing around with a real login, head to this demo site created by the security company Hanko.

Passkeys solve two of the biggest problems with passwords: data breaches and phishing. Passkeys aren’t reused across sites like passwords often are, so stolen credentials do less damage. And since one side of the key is linked to the web-based service itself, it can protect against phishing attempts, because your device should recognize a phishing website as a fake. Passkeys aren’t perfect, but they are expected to be an improvement over the status quo.

For passkeys to be a login option, they need to be both offered by the website you want to log in to and supported by the operating system, browser, or password manager you use. As of late 2022, 1Password’s tracker listed about two dozen sites that support passkeys, but the experts we spoke with all had hopes for continued adoption over the next year. That seems increasingly likely, too, as Shopify, a popular web-store backend for independent shops, in December 2022 announced a new plugin for shop owners to implement passkey support easily.

In the long run, passkeys will be easier and safer for website operators, too, as they will no longer need to store passwords, which means they won’t need to worry about password-database breaches (though they’ll still need to secure the rest of the data they collect).

However, if you’re permanently switching, such as migrating from an iPhone to an Android phone, the process is currently unclear. At the moment you have no way to transfer passkeys from one platform to another, but it is a problem that companies are working on. Mark Risher, Google’s product management director overseeing Android, said that Google is working with the FIDO Alliance to design ways to transfer credentials between platforms: “With regards to transfers in particular, it’s a top priority for us, so we’re exploring a few options that allow portability but don’t open a new channel for attackers to grab ‘the keys to the kingdom.’”

What if you want to share a passkey with someone?

Thinking of new passwords and then keeping them organized and secure is a pain, even with a password manager. But Apple, Google, and Microsoft are working together to support a new way for people to log in to accounts without using passwords at all. Their solution is called a passkey, and though this new sign-in method isn’t yet widespread, it is now rolling out—and it promises to make creating new accounts online and logging in to them securely a lot easier. Here’s what you need to know.

What is a passkey?

If you need a higher level of security on certain accounts, using a physical security key, which doesn’t sync online, may be a better option than using your mobile device.

What happens if you want to switch between devices?

Crocker also pointed out that although a warrant grants access to the contents of a phone, it should not mean that law enforcement is entitled to search the contents of a website account just because the passkey for that site is stored on the phone. For example, a warrant to search your phone does not give police authorization to search your Facebook account just because you have the Facebook app installed on your phone. But because of how passkeys work, this situation can still be problematic. Since you’re using the same form of authorization for both your phone and each service, if law enforcement agents gain access to your device, it could give them access to the associated services, as well, even if they do not have legal authorization for such access.

Passkeys aren’t necessarily replacements for password managers. It will be a long time before every website supports passkeys, so you’ll still need traditional passwords for years to come. But both 1Password and Dashlane have announced passkey support, and other password managers are likely to follow. 1Password’s plans seem comprehensive, as the company is not only allowing you to store passkeys within its password manager, which lets you easily access them across different devices and share them with family, but is also working on tools for you to export your passkeys to other password managers if you leave the 1Password service. Implemented well, password managers could provide better passkey portability between ecosystems than the operating-system-level options do.

Does this mean law enforcement could more easily access your passwords?

“There’s no password attacks when there’s no password present,” Microsoft’s Weinert said. “I’m hugely hopeful about the ability for this to get us to a new era in terms of end-user security.”

Your device’s password or PIN is (or should be) stored in your brain. In the US, the Fifth Amendment, which gives people the right not to be witnesses against themselves, is often invoked when law enforcement attempts to get a suspect to unlock a device. Using your face or fingerprint to unlock a device may not always fall under Fifth Amendment protections, and Electronic Frontier Foundation attorney Andrew Crocker said that, so far, “courts have given more Fifth Amendment protection to the use of a passcode to unlock the device.” Passkeys could be similarly protected, Crocker added.

Passkeys are based on standards developed by the major tech companies. Apple, Google, and Microsoft, along with other tech giants, are working with the FIDO Alliance on passkeys, which are based on what’s known as the WebAuthn standard. You don’t need to remember any of that in order to use passkeys. What’s important is that passkeys should work more or less the same across platforms and will be supported for years to come. “Standards equal security,” said Alex Weinert, Microsoft’s director of identity security. He added that the scrutiny that the standards provide also makes the company more confident about passkeys’ widespread adoption.

Why is a passkey more secure than a username and password?