Passkeys Explained
Article Index
We’ve all been there.
You proceed to throw your unit in frustration.
What is a Passkey?
A passkey is a secure, easy-to-use replacement for passwords.
This allows you to sync and access your passkeys across multiple devices.
Creating a Passkey
Creating a passkey is easy, and the process is similar across most platforms.
Next, I select “Add a passkey,” which creates a passkey specifically for Amazon.
As shown in the screenshot, I had previously created a passkey that’s stored in my iCloud Keychain.
you’re able to create multiple passkeys for the same website and store them in different places.
would have stored the passkey instead.
Proton Pass will now save this specific passkey for Amazon, synced to my username.
Since this is for Amazon, it also works for Amazon Web Services (AWS) accounts.
Why are Passkeys Needed?
According to NordPass’s research, themost popular passwordremains “123456” as of 2023 and 2024.
The second most popular?
Other common passwords are usually strings of sequential numbers or variations on “qwerty.”
Where Can I Use Passkeys?
While not every service has implemented passkey authentication, most popular sites have.
Dashlane offers a helpful,community-driven directoryof websites that have implemented passkeys login functionality.
you’re free to already create passkeys using Google, Microsoft, or Apple devices.
Manypassword managers such as Proton Pass, Dashlane, 1Password, Bitwarden, and LastPass also support passkey creation.
As mentioned earlier, using a password manager allows passkeys to sync across devices.
It’s also important to remember that passkeys are unique to each website.
They are part of theFIDO2 project, which aims to permanently replace passwords as a method of authentication.
The core concept relies on public key infrastructure (PKI).
Instead of storing a username and password, passkeys are generated on an authenticator controlled by the user.
Passkeys also require biometric authentication (like Face ID or a fingerprint) to use.
Even if someone steals your phone, they can’t access your passkeys without your biometric data.
Even open-source options like KeePass require a database of passwords.
Even open-source tools like KeePass require you to maintain a password database.
Passkeys offer a more secure and streamlined approach by eliminating the need to manage individual logins.
Phishing typically aims to steal usernames, passwords, or sensitive data.
Passkeys don’t transmit credentials, making them useless to an attacker even if intercepted.
At most, an attacker might gain access to the public keys stored in the database.
Since these can’t be used to reverse-engineer your private key, your account remains secure.
If needed, you’re free to simply revoke the old passkey and generate a new one.
The purpose of passkeys is to provide personal, identity-bound authentication not shared credentials.
But technically, yes, there are ways to share passkeys.
For example, Apple allows passkeys to be sharedvia AirDropunder certain conditions.
you’ve got the option to also share passkeys by logging into the same password manager.
Here are a few examples:
Shared accountsPasskeys are tied to you and your machine.
In such cases, passkeys aren’t practical.
This could also extend to software needing to use authentication for secure API calls.
Additionally, there are environments where passkey adoption just doesn’t fit yet.
