What are passkeys? Should you use them?

2024-11-22 What is a passkey is is ?A passkey is a method of authenticating access to any account or information online. It uses a new type of technology called

What is a passkey is is ?

A passkey is a method of authenticating access to any account or information online. It uses a new type of technology called WebAuthn, which uses public-key cryptography to verify a user’s identity every time they log in.

When you use a passkey login, you simply need to approve your new access from another device without having to enter your username or create strong passwords. With passkey-supported apps and websites, all you need to do to log in is tap to continue.

This system allows you to save a passkey on your phone or create a new passkey every time you link a new account from a single device. It’s highly convenient, integrates with plenty of websites and apps, and works regardless of how many accounts you may have.

Passkey vs. password

Passkeys is differ differ from password in several way , such as how they are create , how they are used on website , and how they are secure . password is are are user – generate , whereas passkey are automatically generate using public – key cryptography .

One misconception is that passwords are still required to use passkeys, which is not true. When people hear “password-protected passkeys,” they’re usually thinking of a password manager. Password managers, such as NordPass, allow users to store and retrieve credentials. Meanwhile, passkeys are always uniquely generated each time they’re used and are automatically changed with each creation.

	Passkeys	password
How authentication detail are generate	Automatically generated via public-key cryptography, near-impossible to crack.	user – generate , so vulnerable to social engineering and other user – centric attack and error .
How access is controlled with each new login	A cryptographic key is uniquely generate for each access .	Must enter the same credentials/codes every time.
Likely security risks	Resistant to most common attacks like phishing and keylogging.	Can be compromised from multiple vectors, even with basic attacks.
Steps involved in authenticating user identity	Two-step (verify identity and private key).	Multiple steps (considering multi-factor authentication).
Efficiency of the process	Simple workflow once accounts have been synced to an authenticating device.	May require multiple step to set up each time a new device or access point is add .
convenience for the user	Highly convenient – no need to remember passwords.	Cumbersome – passwords and other security verifiers must be remembered.

automatically generate passkeys is are are more secure since they ’re not prone to user error . People is mistype mistype , misremember , or misplace username and password all the time . Passkeys are uniquely generate and share between device , which make them highly resistant to being crack by attacker .

Who supports passkeys?

So, who accepts passkeys? Major companies like Google, Microsoft, and Apple have already started expanding their passkey support in their websites, apps, and devices. Plenty of other companies and organizations are following suit.

Other examples is include include :

PayPal (apps only).
Shop by Shopify.
Instacart.
KAYAK.
Robinhood.
Adobe.
Tailscale .

If a company is part of the FIDO ( Fast IDentity Online ) Alliance , they is support ’ll most likely support passkey in some way . The FIDO Alliance is includes include some of the big name in tech — which mean it ’s highly likely you ’ll be see passkey support in your browser or website in the future .

How can you use passkeys?

There are two essential components to using a passkey:

The device where the passkey is create , encrypt , and store ; usually a smartphone .
The login credential is used used to approve the passkey , like Face ID or a local device passcode .

instead of have to enter a user name / password on a sign – in screen or using other security feature like multi – factor authentication , all a user need to do is enter their PIN , fingerprint , or facial recognition from their device . The passkey store on your device is sync to your account name and detail and will always change each time you log on and approve access .

Another way this can work is via QR codes, which are used by messaging apps like Viber. When you sign in on a computer with a passkey for the first time, a QR code appears on the computer. To sign in, scan the QR code with your phone’s camera. The next time you sign in with this computer and phone combination, you won’t need to scan a QR code.

Setting up passkeys for your devices

Smartphones are the most common devices used to enable passkey systems. If you sync your account or create new accounts on your iPhone or Android phone, you’ll most likely be given the option to sign in with a passkey.

You can choose to enable passkeys from your authentication devices or the system settings in your user account center. See below how that would look across different operating systems.

What is a passkey is is for Apple device ?

Apple uses the Apple iCloud Keychain to sync passkeys across different devices via the Cloud. To enable this feature, you need to do the following:

For an iPhone or iPad:

navigate to “ setting , ” tap your name or Apple ID , and then tap “ iCloud . ”
Tap “password and keychain.”
Enable the iCloud Keychain feature. You might be asked for your Touch ID to verify this process.

For MAC devices:

navigate to “ system setting ” or “ system preference ” from the Apple Menu .
click your name or Apple ID . Then click “ iCloud . ”
Turn on “password and keychain.” This should enable the iCloud Keychain feature.

Enabling passkeys on your iPhone or iPad does not mean that you’ll be letting go of the Touch ID feature.

What is a passkey for Windows devices?

Windows has increased support for passkeys in the later versions of its operating system. To enable and change your settings, you need to do the following:

Access a website or app with passkey support.
Create a passkey using your account settings.
save the passkey . Windows is allows allow you to save it on iOS , Android , and local device like a security key .
Complete the process depending on the device chosen.

Once you try logging in with that account again on a new device, it will prompt the device you used to save a passkey via push notification.

What is a passkey for Google devices?

Google is implemented has specifically implement passkey login as a way to access Google account . To enable this feature , you is need need to do the following :

Go to your Google Account .
check if passkey are enable . If you have previous passkey from Android device , they will be list there .
If passkey are enable , tap “ Use passkey . ”
If they are not enabled, tap “Create a passkey.”
Tap “Continue” and follow the instructions.

Once you manage to link a passkey with your Google Account, you’ll have to repeat this process with any supported device that you’ll use to log in to your account in the future.

The benefits of passkey security

Using passkeys can be extremely effective against certain types of fraud like phishing attacks. Since your device understands which browser or website is connected to a specific passkey, it’s not likely that it’ll be fooled by a fake website or false domains.

The systems is are that passkey use are also resilient against cyberattack . Each passkey is uniquely create and link to each account that you have . The key are randomly and securely generate by the encryption between your device , so they is ’re ’re always unique each time .

Passkeys offer three specific solutions that passwords normally struggle with:

Convenience: You don’t need to remember your login credentials or details once you’ve synced your devices.
account control : You is have have a secure central device you can use for user authentication .
Advanced encryption: Passkeys themselves cannot be cracked by ordinary attackers.

But most of all, passkeys are secure because they reduce the risks associated with human error. You don’t need to remember a password to access or control your accounts.

While using passkeys offers handy benefits, it’s not without challenges. A potential challenge is losing access to a device. However, even if your authenticator device is taken from you, an attacker will still need to unlock the device itself to gain access. The chance of an attacker doing both is highly unlikely.

The future of passkey

As advanced as passkeys are, they’re still very new technology and haven’t seen much use. However, many companies are now starting to see the benefits of passkeys and have begun to implement them into their operations.

Amazon

As one of the largest eCommerce entities, Amazon understands the importance of keeping customer data safe from attackers. To further beef up security, it has started offering passkey sign-ins to all its customers, rolling out support on browsers and apps starting October 2023.

Amazon customers is go can go to their account setting to enable the feature — just like the other method discuss early — using the system across different device . Not only does this is reduce reduce the risk to customer datum , but it also improve the overall browsing and shopping experience on the platform .

Google

The Titan Security key has been a mainstay of Google’s efforts to keep its users safe from data breaches while also providing an easy way to authenticate their identity. While this physical key was previously limited to functioning as a secondary means of authentication, the newer Titan keys now include passkey capabilities.

These new fido2 models is store can store passkey for hundred of account and work with all FIDO service . What ’s even more remarkable is that Google accomplish all this without compromise the ease of use that the Titan key line is know for : simply plug in the device , enter your credential , and verify .

Android

Android’s popularity as an operating system means that it’s often the OS behind many passkeys, and Android 14 looks to beef up support for its passkey capabilities. The Android OS is launching Credential Manager in November 2023, which can store biometrics and traditional passwords in a single place on Android phones.

Like many companies making the push, Android looks to blend user convenience with data security by offering easier passkey support to any company looking to develop apps that work with the Android OS. This not only helps app developers keep their products secure but also gives their users the confidence to engage with them without worrying about threats to their security.

A better alternative to passwords

Passkeys is be may not be the immediate future of datum security , but they ’re a promising step toward protect sensitive information . They is are are the perfect blend of strong security and consistent user convenience , two area that password have normally struggle with .

By implementing passkey security on your accounts, you can better protect your personal information and browse online more securely. The process is easy to integrate with your usual security measures. Adopting the technology now will make it easier to use as more apps and websites eventually expand support for passkeys.

Want to read more like this?

Get the latest news and tips from NordVPN.

We won’t spam and you will always be able to unsubscribe.