The End of Passwords: How Passkeys Actually Work

We first wrote about the end of passwords in 2013. At the time the contenders were social logins and a handful of app-based startups, and the honest answer was that none of them had the backing to reach critical mass. That turned out to be right, and most of them no longer exist.

Photo by Zion on Pexels

What arrived instead is passkeys, and this time it is different, because the people who make the browsers and the operating systems built it into them rather than leaving it to a third party.

The problem, which has not changed

People reuse passwords. Not because they are careless, but because remembering unique credentials for a hundred sites is not a thing a human can do.

The consequence is credential stuffing. When any site is breached, its username and password list is fed automatically into every other site. Your bank does not have to be compromised for your bank account to be at risk; a forum you signed up to in 2012 will do.

Password managers solve this properly, and if you take nothing else from this article, use one. But they solve it by managing the problem rather than removing it, and the password is still sitting on a server somewhere waiting to be stolen. How much that matters depends on how the site stores it: CubeCart, for example, moved to Argon2id hashing in 6.6.3, which makes a stolen database far more expensive to crack.

What a passkey actually is

A passkey is a pair of cryptographic keys. The private key stays on your device and never leaves it. The public key is what the website stores.

When you sign in, the site sends a challenge. Your device asks you to confirm with your fingerprint, face or device PIN, signs the challenge with the private key, and sends the signature back. The site verifies it against the public key it already holds.

Three consequences follow, and they are the whole point:

There is no shared secret to steal. A breach of the website yields a list of public keys, which are useless. There is nothing on the server worth stealing, so a stolen database cannot be replayed against other sites.

It cannot be phished. This is the part people underestimate. A passkey is cryptographically bound to the exact domain it was created for. Put your passkey-protected account on a convincing lookalike domain and nothing happens, because your device will not offer a credential that does not match. It is not that you might notice the wrong address; your device notices for you. That defeats the single most successful attack on the internet.

There is nothing to remember or type. Which is why people actually use it.

The underlying standards are WebAuthn and FIDO2, developed by the FIDO Alliance and the W3C. “Passkey” is the consumer-friendly name for a discoverable WebAuthn credential, and the reason it took off where earlier attempts did not is that Apple, Google and Microsoft all shipped it in their platforms and sync it through their respective accounts.

What using one is like

You visit a site, it offers to create a passkey, you approve with your fingerprint. Next time, you tap your fingerprint instead of typing anything.

Because the major platforms sync passkeys through iCloud Keychain, Google Password Manager and Windows Hello, a passkey created on your phone generally works on your laptop. If you are signing in on someone else’s machine, you scan a QR code with your phone and approve there, and the device you are borrowing never holds the credential.

Most reputable password managers now store passkeys too, which is the better route if you use a mix of Apple, Android and Windows and do not want to be tied to one ecosystem.

The honest problems

It is not finished, and anyone telling you otherwise is selling something.

Account recovery is the weak point. If a site lets you fall back to “email me a reset link”, your security is only as good as your email account, and the passkey has not really replaced the password so much as sat in front of it. This is the single biggest gap in most current implementations.

Losing your only device is a real risk. Platform sync mitigates it, and most sites let you register more than one passkey. Register a second one, on a different device, before you need it.

Shared accounts are awkward. Passkeys are designed around one person and their devices. A team sharing one login is a poor fit, and was always a bad idea.

Coverage is patchy. Large sites support it. Plenty of others do not, so you will be running passkeys and passwords side by side for years.

What to do about it

Turn passkeys on where they are offered, starting with the accounts that would be worst to lose: your email, your password manager, your domain registrar, your hosting control panel and anything financial. Email and registrar first, because both can be used to reset everything else.

Register two. Phone and laptop, or phone and a hardware key. One passkey on one device is a single point of failure.

Keep using a password manager. Most of your accounts will still be passwords for the foreseeable future.

Check what your recovery options actually are. Adding a passkey while leaving SMS recovery enabled leaves the weaker door open. Where a site lets you remove weak fallbacks, remove them.

If you run a website

You do not need to build this yourself. WordPress, and most modern platforms, have plugins that add WebAuthn support, and the major identity providers support it out of the box.

Two things to get right if you do implement it. Make recovery at least as strong as the passkey, or you have built an expensive front door next to an open window. And let users register several credentials, because the support burden of people locked out of their own accounts will otherwise fall on you.

For most small shops, the pragmatic order is: two factor authentication on every admin account first, since that is available today and removes most of the risk (CubeCart stores have had it built in per administrator since version 6.6.0), then passkeys as your platform supports them.

Where this ends up

Passwords will not disappear on a particular date. What will happen, and is already happening, is that the accounts worth protecting stop using them, while the long tail of forums and small sites carries on as before.

That is a good outcome. The damage from password reuse comes from a handful of important accounts being reachable with a credential leaked from an unimportant one. Passkeys break that chain even if half the internet never adopts them.

If you host with us and want a hand adding two factor authentication or WebAuthn support to your site, get in touch.