Explainer

What Are Passkeys and How Do I Use Them?

By Brian Burgess

Published November 5, 2023

Passkeys are a new secure sign-in technology that offers a password-free sign in experience. Here’s what they are and how to use them.

There is a lot of tech jargon out there, and recently, a new term has emerged. Have you asked yourself, “What are passkeys, and how do I use them?” Well, the data is in, and the result is clear: passkeys provide a quick and secure password-free sign-in experience for your favorite websites and apps.

Adding passkeys to supported services is more straightforward than using password managers, strong, complex passwords, and setting up two-step verification (2SV) or two-factor (2FA) authentication with authenticator apps. In fact, passkeys are more secure than 2FA, and a passkey implements four stages of authentication.

Currently, only a handful of sites and apps support passkeys, but as the passkey technology evolves, you can expect to see the option virtually everywhere. 2FA was similar in that it started rolling out slowly and is now available virtually everywhere.

So, let’s dive into what passkeys are and how and why you would want to use them.

What Are Passkeys?

A passkey is a secure way to sign into your apps and websites. When you generate a passkey, two keys are created. One key is stored with the service on the company’s servers, and the other is stored locally on your device.

Passkeys are built on the Web Authentication (WebAuthn) standard that uses public-key cryptography to secure your accounts better. Attackers can’t use phishing attacks or social engineering to steal your passkey login credentials.

When a passkey is created, you use a fingerprint scan, Windows Hello on a PC, Face ID on an iPhone, or a unique passcode to sign into the app or website. Once the two keys are paired and authenticated, you will be signed into the service.

But don’t worry about waiting. The process happens instantly, and you’ll be signed into the service.

Passkeys enhance security in four different ways. You have the security layer of biometrics. Hackers can’t access the passkey stored on your device. The passkeys are encrypted. Also, each passkey is unique to your specific account. So, unlike passwords, nobody can figure out your passkey and apply it to other accounts.

Note that when you initially create a new account for a service, you still want to use a unique and strong password and enable 2FA. Once that’s done, you can set up your passkey on supported apps and sites to get a password-less sign-in experience.

How Do I Use Passkeys?

You can use passkeys on sites and apps that support the sign-in technology. Once you create a unique passkey for an app or website, you sign into the service using your fingerprint or face. It’s just like signing into your phone.

Each service varies, but to create or set up a passkey, you need to go into your account settings for the service and see if the passkey sign-in option is listed.

Several major services currently offer passkey support, and we’ve covered some of the major ones, including Google, Amazon, and Apple.

For example, we’ve shown you how to create a passkey for your Google account and set up passkeys for Amazon. We’ve also shown you how to use passkeys on your iPhone. Make sure to reference those articles to learn more about using the passkey technology.

The list of known sites and apps that support passkeys continues to grow, and you can expect to see more over time. For instance, sites like BestBuy, PayPal, Kayak, Google, eBay, WordPress, and GoDaddy are among the list of services with passkey.

Using Passkeys Everywhere

Passkeys are designed to phase out usernames and passwords which have always had security issues. This is notable when you use the same password on multiple sites and don’t enable 2FA.

Passkeys are more secure than 2FA since a passkey uses four different factors to unlock your account. This may sound complicated, but the passkey experience is like unlocking your phone with your fingerprint or face, making them a breeze to use.

No more complicated passwords or the need for a second authentication step like getting verification codes via text or using another authenticator app.

Also, it’s important to reiterate that passkeys are more secure than 2FA and much easier to use. We look forward to a future where we can ditch the passwords and sign in to sites securely, and the future is now.

Passkeys offer a more secure sign-in experience, and they are easier to use on sites that support the technology. Head to one of the services you use today, and you’ll see the difference.