Passwords are the original sin of the internet. Chosen by humans, they are reused across sites, stolen in breaches, guessed by attackers, and phished from users who cannot tell a legitimate login page from a fake one. Decades of efforts — complexity requirements, rotation policies, password managers — have patched the problem without solving it. Now, an industry-wide push toward a fundamentally better authentication mechanism is finally gaining momentum. It is called passkeys, it is built on open standards called FIDO2 and WebAuthn, and it may actually kill the password.
Why Passwords Fail
Password security rests on two assumptions: that passwords are secret and that they will not be reused. Both fail constantly. Credential-stuffing attacks — trying stolen username-password pairs across many services — succeed because people reuse passwords. Phishing succeeds because passwords are bearer tokens: anyone who knows a password can present it, and it is hard for a user to distinguish a real site from a well-made fake.
Even strong, unique passwords are vulnerable to phishing and to server-side breaches, which leak entire databases of hashed credentials. The fundamental problem is architectural: a password is a shared secret, and shared secrets are inherently leakable.
How Passkeys Work
Passkeys replace the shared secret with public-key cryptography. When a user registers a passkey, their device generates a key pair: a public key, stored on the server, and a private key, stored securely on the user’s device (often in the device’s secure enclave or TPM, and synced across devices via the platform — Apple iCloud Keychain, Google Password Manager, or Microsoft’s equivalent).
To sign in, the service sends a challenge. The user authenticates to their device — with a fingerprint, face scan, or device PIN. The device signs the challenge with the private key, and the server verifies it with the public key. The private key never leaves the device, and no shared secret is transmitted.
This design has profound security implications:
- No credentials to steal: A server-side breach of the service yields only public keys, which are useless to attackers.
- No phishing: The private key is bound to the specific domain it was registered for, so a fake site cannot trick a user into releasing it.
- No reuse: Each account has its own key pair, so credential-stuffing becomes impossible.
The Standards Backbone
Passkeys ride on standards developed by the FIDO Alliance and the World Wide Web Consortium (W3C). FIDO2 consists of the WebAuthn browser API and the CTAP protocol for communicating with authenticators. The key innovation is “discoverable credentials” — passkeys stored on the device that can be found when a user visits a site, enabling adoption by existing platforms.
Adoption Momentum
The big three platform vendors have thrown their weight behind passkeys. Apple added passkey support in 2022 across iOS, iPadOS, and macOS. Google rolled out support in Android and Chrome and, in 2023, made passkeys the default sign-in option for personal Google accounts. Microsoft supports passkeys in Windows and its authenticator. In May 2025, Google announced that passkeys had been used to authenticate into Google accounts more than five billion times, and that over 400 million Google accounts had used passkeys. Microsoft reported over a billion passkey-based sign-ins in early 2025.
Consumer-facing companies have followed: Amazon, PayPal, eBay, WhatsApp, Uber, and major banks now offer passkey sign-in. Password managers like 1Password and Dashlane added support. The ecosystem has crossed from early adopter to mainstream rollout.
Why Passwords Haven’t Died Yet
Despite the momentum, passwords remain deeply embedded, and the transition is slow for understandable reasons:
- Backward compatibility: Most services still offer password sign-in as a fallback, which means the phishing surface persists.
- Account recovery: Recovering an account when a user loses their device remains a hard problem, often relying on the very fallbacks (email links, security questions) that weaken security.
- Regulatory friction: Some regulators and auditors still expect password-based controls and have been slow to update.
- User familiarity: Passkeys change the mental model, and some users find them confusing, though they are generally easier in practice.
- Interoperability edge cases: Cross-platform syncing works, but mixed ecosystems (e.g., an Apple user signing into a service on Windows) can present friction, though QR-code flows have eased this.
The Enterprise Problem
Enterprises face the hardest transition. Legacy applications, directory services, and custom auth flows are not passkey-ready. Workforce use cases are increasingly supported — passkeys in Microsoft Entra ID (Azure AD), for example — but integrating passkeys across on-premises and legacy systems takes years. The most realistic enterprise path is a phased migration, with passkeys for new and high-value services while passwords linger elsewhere.
What Comes Next
The trajectory is clear: passkeys are the successor technology, and the industry has committed to them. The FIDO Alliance and platform vendors continue to refine cross-device flows, recovery, and support for emerging form factors. The vision is “passwordless by default” — services that require passkeys and treat passwords as a deprecated exception.
The Recovery Problem
Account recovery without passwords is the hardest open problem in the passkey transition. If a user loses all their devices — phone stolen, laptop destroyed — and stored passkeys are gone, how do they prove their identity? The fallback today is frequently the very insecure mechanisms passkeys were meant to replace: SMS codes, email magic links, or security questions. Those fallbacks weaken the system. Solutions under development include hardware-bound backup keys, social-recovery mechanisms using trusted contacts, and time-delayed recovery that requires multiple factors over hours. None is elegant, and this tension — strong security versus practical recovery — will be the primary friction in passkey adoption.
Passkey Portability and Platform Lock-In
Users who switch platforms — from an iPhone to an Android, say — face a practical challenge: passkeys synced to one ecosystem do not automatically transfer to another. The FIDO Alliance has published draft specifications for cross-platform passkey transfer, and major vendors are working on interoperability. Until that is seamless, passkeys risk creating the same platform lock-in that they were meant to avoid, just with different tech. In the meantime, password managers that support passkeys across platforms provide a bridge, but at the cost of relying on a third-party credential store — a trade-off some users accept and others resist.
Supply Chain and Enterprise Adoption
Enterprises are the hardest environment for passkeys because they combine legacy applications, diverse operating systems, and workforce users who log in from shared or temporary devices. Microsoft has integrated passkeys into Entra ID, and Okta and other identity providers support them, but the long tail of internal applications, legacy VPNs, and line-of-business tools will take years to modernise. Hybrid approaches, where passkeys cover the main gateway and passwords persist for legacy systems behind it, are the most realistic near-term path. The enterprise reality is that passkeys are arriving, but they are arriving gradually and unevenly.
Hardware Keys and the High-Assurance Tier
For the highest-assurance use cases, platform-stored passkeys may not suffice. Hardware security keys — dedicated USB, NFC, or Bluetooth devices that store credentials in tamper-resistant chips — remain the gold standard, resistant to malware that might compromise a phone or laptop key store. They are required by some organisations for privileged accounts and by CISA’s zero-trust guidance. The friction of carrying a key limits adoption, but the security properties are unmatched. For journalists, executives, and system administrators, hardware keys are a bridge between legacy security-token thinking and the passkey future.
Regulatory Momentum
Regulators are accelerating the transition. The U.S. government’s zero-trust mandate requires phishing-resistant multifactor authentication, and CISA explicitly recommends passkeys. Europe’s updated digital identity framework pushes similar direction. Cyber insurance increasingly prices in whether an organisation uses strong authentication. These pressures will drive passkey deployment even in organisations that might otherwise move slowly. Combined with declining vendor support for legacy MFA methods like SMS codes, the regulatory and actuarial tide is running strongly toward passkeys.
Biometrics and the Identity Foundation
Passkeys rely on local authentication — a fingerprint or face scan — to unlock the private key. That places biometrics at the heart of the identity stack, with all the attendant privacy questions. The biometric data is stored on the device, not sent to the server, which is a genuine privacy advantage over server-side biometric systems. But it also means that a device compromise or a coerced unlock — a user forced to present a finger — could expose credentials. Hardware keys that require a physical touch and a PIN mitigate coercion by requiring something the user knows and has, rather than something they are. The design choices around biometrics in passkeys are a window into the broader societal negotiation over identity, privacy, and coercion in a security-conscious world.
Conclusion
The password was never good; it was just universal. Passkeys are genuinely better — by architecture, not merely by policy. Cryptographically bound to the site, unphishable, and immune to database theft, they remove entire categories of attack. The remaining work is the unglamorous part: adoption, recovery, backward compatibility, and the slow work of migrating a world built on shared secrets. The password may not be dead yet, but its obituary is being written — and for once, the replacement looks like a real solution rather than another patch.
