Passkeys instead of passwords: how modern sign-in works

Another password? Another reset link? Many of us know the problem. Passkeys promise a more comfortable sign-in experience and can make certain phishing attacks significantly harder. But how does signing in without a conventional password work? And what happens if you lose your smartphone? Let us examine the technology without unnecessary jargon.

Why conventional passwords cause problems

Does this sound familiar? Every tool is supposed to have a different, long password. In practice, this can lead to reused passwords, insecure notes or more password-reset emails. Even a good password can be disclosed on a fake sign-in page when someone falls for a convincing phishing message.

Passkeys address this problem through authentication with a cryptographic key pair. Put simply, the private key stays on a device or in a suitable secure storage system; the service receives the corresponding public key. Signing in involves approving a request, often using a device PIN or biometrics.

What passkeys do better, and what they do not solve

An important advantage is their binding to the relevant service. A passkey for one website cannot simply be used on a fake domain. This helps against common phishing attacks. Users also do not have to type a secret that someone could read over their shoulder.

The method does not solve every security problem, however. A compromised device, insecure recovery procedures or poorly protected sessions can still create risks. Services also differ in how well they support passkeys. Device locking, up-to-date software and a carefully planned recovery process therefore remain important.

How to introduce passkeys in a business

Begin with a small number of services and a limited user group. Check whether passkeys are offered as the main sign-in method or as an additional option. Decide how new devices will be set up and what happens if someone loses their device. An account without a securely defined recovery route may be difficult to access in an emergency.

Administrators should consider additional protection for particularly important accounts and test their recovery procedures. For services without passkeys, continue using a password manager with unique passwords and, where available, an additional sign-in confirmation.

Practical example: signing in to an editorial system

A magazine has an administrative account and several regular user accounts. The editorial team initially wants to test passkeys as an optional feature. Employees register a passkey on their work device and test signing in. A secure recovery route remains available in parallel. After a successful test, the team documents how to add a new device or block a lost one.

Passkeys could later be offered to readers voluntarily. A clear interface matters: “Sign in with a passkey” should explain what to do instead of assuming technical knowledge.

Conclusion

Passkeys can make signing in easier and more robust against typical phishing attacks. Introducing them successfully involves more than a new button. Pay attention to secure devices, a tested recovery route and clear explanations for users. Modern technology can then make everyday work genuinely easier.

Sources and further reading

The following original sources and official documentation provide further background. Always check the current position for legal and other changing topics.

• fidoalliance.org

Note: This article provides general information in a German or European context and does not replace individual legal advice.