Passwords Are Dead: Passkeys Explained
Passkeys replace passwords with cryptographic keys. Here is how they actually work, why they are more secure, and how to start using them today.
Passkeys are a replacement for passwords that uses cryptographic key pairs instead of a shared secret. They are phishing-resistant by design, easier to use, and are now supported by every major platform. If you still log in with a password, you are carrying a risk you can eliminate.
How passkeys actually work
When you create a passkey, your device generates a key pair:
- A private key that never leaves your device.
- A public key that is sent to the website and stored on its server.
When you log in, the website sends a challenge. Your device signs the challenge with the private key, and the website verifies the signature with the public key. The private key never travels over the network.
| Property | Password | Passkey |
|---|---|---|
| Shared secret | Yes | No |
| Phishing-resistant | No | Yes |
| Reusable across sites | Common (bad) | Impossible |
| Database breach exposes it | Yes | No |
| You can forget it | Yes | No |
Why passkeys are more secure
The core problem with passwords is that they are a shared secret — the same secret is stored on your device and the server. If the server is breached, your password is exposed. If you reuse it, every account is exposed.
Passkeys remove the shared secret. A database of passkeys contains only public keys, which are useless to an attacker. And because a passkey is cryptographically bound to the site it was created for, a phishing site that looks identical cannot trick your device into signing in.
How to use them
On iPhone or Android, passkeys are built in and sync through your platform’s password manager (iCloud Keychain, Google Password Manager). On desktop, you can use your phone to approve sign-in via QR code, or use a security key (USB/NFC) for the highest assurance.
To try it, go to a site that supports passkeys — GitHub, Google, Apple, and many others — and choose “Create a passkey” in your security settings.
What about losing your device?
This is the most common concern, and the answer is platform sync. Because your passkeys sync through iCloud Keychain or Google Password Manager, signing in on a new device restores them. For accounts that matter, also keep a recovery method registered — a second device, a security key, or the service’s account recovery.