Passkeys Explained: Logging In Without Passwords
Passwords are the weakest link in most small business security. They get reused, guessed, phished and forgotten. Passkeys replace them with a sign-in that uses your fingerprint, face or device PIN, and they cannot be typed into a fake website. Here is what passkeys are, how they work and how to roll them out without locking anyone out.
Key takeaways
- A passkey is a passwordless sign-in standard from the FIDO Alliance and W3C, built on a pair of cryptographic keys.
- You unlock a passkey with your fingerprint, face or device PIN, and the secret part never leaves your device or password manager.
- Passkeys resist phishing because they only work on the website or app they were created for.
- Turn them on for your most important accounts first, and always keep a backup way to sign in.
If you run a small business, you already juggle dozens of logins: email, banking, accounting, payroll, social media, your website and every app in between. Our guides to password managers and two-factor authentication explain how to make passwords safer. Passkeys go a step further by removing the password from the sign-in altogether.
Support for passkeys has spread across many major services, operating systems and password managers. That does not mean every app you use supports them yet, and the details of setup vary by service. This guide explains the concept so you can recognize the option and use it well.
What is a passkey?
A passkey is a digital credential that lets you sign in to a website or app without a password. It is based on a standard called WebAuthn, developed by the FIDO Alliance (an industry group focused on authentication) and the W3C (the body that sets web standards).
When you create a passkey, your device generates two linked keys:
- A private key, which stays on your device or in your password manager and is never sent to the website.
- A public key, which is stored by the website. On its own, it cannot be used to sign in.
When you sign in, the website sends a one-time challenge. Your device signs it with the private key after you unlock it with your fingerprint, face or PIN. The website checks the signature with the public key. If it matches, you are in. No password is typed, stored on the server or sent over the internet.
Plain English version
Think of the website holding a padlock that only your device's key can open. The website keeps the padlock, you keep the key, and your fingerprint or PIN is what lets you use the key. Even if someone steals the website's padlocks, they still do not have your key.
Why passkeys are safer than passwords
Passkeys fix several of the problems that make passwords risky for small businesses.
| Problem with passwords | How passkeys handle it |
|---|---|
| Phishing: staff type a password into a fake login page | A passkey only works on the exact site it was created for, so a look-alike site cannot use it |
| Reuse: one leaked password opens several accounts | Every passkey is unique to one site or app |
| Data breaches: stolen password databases | The website stores only a public key, which is useless to attackers on its own |
| Weak or guessable passwords | There is nothing to guess; keys are generated by the device |
| Forgotten passwords and resets | You sign in with the same fingerprint, face or PIN you use to unlock your device |
The phishing resistance is the big win. Most business account takeovers start with someone entering a password on a convincing fake page. Our guide on how to spot and stop phishing covers the warning signs, but passkeys make the attack much harder even when someone does click the wrong link, because the passkey simply will not work on the fake site.
Where passkeys are stored
Your passkeys have to live somewhere. There are three common options, and you can mix them.
Synced through your platform
Apple, Google and Microsoft can store passkeys in their account systems and sync them across your devices signed in to the same account. Create a passkey on your phone and it can be available on your laptop too. This is convenient, but it ties your passkeys to that platform account, so protect that account carefully.
Stored in a password manager
Many password managers can now save and sync passkeys alongside passwords. For businesses, this can be the most practical option because it works across different brands of devices and fits into shared vaults and admin controls. Check your password manager's current documentation for what it supports.
On a single device or security key
A passkey can also be bound to one device, such as a hardware security key that plugs into a USB port or taps via NFC. These do not sync, which some businesses prefer for the most sensitive accounts, such as admin logins.
How to start using passkeys in your business
You do not need a big project to adopt passkeys. Start with the accounts where a takeover would hurt the most and expand from there.
- Pick your storage approach. Decide whether the team will store passkeys in your business password manager or in platform accounts. A consistent choice makes support and offboarding easier.
- List your critical accounts. Typically email and productivity suite, domain registrar, website admin, banking and payments, accounting, payroll and social media admin accounts.
- Check which support passkeys. Look in each service's security or sign-in settings for an option to add a passkey. The wording and location vary and change over time.
- Create passkeys on the main devices. Follow the prompts to create a passkey and unlock it with fingerprint, face or PIN.
- Set up a backup sign-in method. Keep at least one other way in, such as a second passkey on another device, a hardware security key or recovery codes stored securely.
- Test it. Sign out and sign in again with the passkey on each device you will use, before you rely on it.
- Remove weak fallbacks where you can. Once passkeys work reliably, consider whether the service lets you turn off password-only sign-in or weak recovery methods such as text message codes.
Common mistake
Creating a passkey on one phone and nothing else. If that phone is lost, broken or reset, you may struggle to get back into the account. Always register a backup sign-in method, and check that synced passkeys really appear on your other devices.
Passkeys and your team
Rolling passkeys out to staff takes a little planning, mostly around ownership and recovery.
- Use individual accounts. Passkeys are personal. Shared logins do not fit them well, which is another reason to give each person their own account with appropriate permissions.
- Prefer business-managed storage. If staff store work passkeys in personal platform accounts, you lose visibility when they leave. A business password manager or managed devices keep control with the company.
- Explain the change. Some people worry that passkeys send their fingerprint to the website. They do not: the fingerprint or face check happens on the device, and only the cryptographic signature is sent.
- Plan for lost devices. Make sure an admin can reset a staff member's sign-in methods in your main systems, such as your email or productivity suite admin console.
- Include passkeys in offboarding. When someone leaves, disable their account and remove their registered devices and security keys.
Hypothetical example
Imagine a bookkeeping firm with six staff. A partner receives a convincing email that appears to come from their accounting software, asking them to sign in to review an invoice. The link leads to a fake page. Because the firm switched the accounting login to passkeys stored in its password manager, there is no password to type, and the passkey does not offer itself on the unfamiliar site. The partner notices something is wrong and reports the email. The scenario is invented, but it shows how passkeys blunt the most common attack.
Advantages
- Strong protection against phishing and credential reuse
- Faster sign-in with fingerprint, face or PIN
- Nothing useful for attackers to steal from the website
Current limitations
- Not every service supports passkeys yet
- Setup and recovery options vary between services
- Moving passkeys between ecosystems can be less smooth than moving passwords
Your passkey action plan
- Choose where your business will store passkeys
- List your most critical accounts and check passkey support
- Add passkeys to email, banking, domain and admin accounts first
- Register a backup device, security key or recovery codes for each
- Test signing in on every device before relying on passkeys
- Brief staff on how passkeys work and why they are safer
- Add passkey and device removal to your offboarding process
Frequently asked questions
Does the website get my fingerprint?
No. Your fingerprint or face is checked locally by your device to unlock the passkey. The website only receives a cryptographic signature that proves you hold the right key.
What happens if I lose my phone?
If your passkeys are synced through a password manager or platform account, they will be available on your other devices once you sign in. If not, use your backup method, such as a security key or recovery codes, and then remove the lost device from your accounts.
Do I still need two-factor authentication?
A passkey already combines something you have (the device holding the key) with something you are or know (your fingerprint, face or PIN), so many services treat it as strong authentication on its own. Keep two-factor authentication on accounts that still use passwords.
Should I delete my passwords once I have passkeys?
Not right away. Many services still require a password as a fallback. Keep strong, unique passwords in your password manager until you are confident passkeys work everywhere you need them, and follow each service's guidance.
Related reading
The bottom line
Passkeys are the most practical step most small businesses can take toward phishing-resistant sign-in. They are faster for staff and much harder for attackers to abuse. Start with your critical accounts, store passkeys somewhere the business controls, always keep a backup way in, and expand as more of your apps add support.
