Why might passkeys finally make passwords disappear?

Passkeys might make passwords disappear because they remove the thing that makes passwords so easy to attack: a secret that you type and a server that has to check it. With a passkey, your device keeps a private key that it never sends to the website. The website holds only a matching public key, which is useless to a thief on its own. To log in, the site sends a challenge that only your secret key can answer, your device answers it, and you are in. You never type or send a secret, so there is nothing for a fake site to capture.

Think about how weak passwords really are. People routinely reuse the same one across services, choose weak ones that can be guessed in a short time, and store them in careless ways. Websites in turn often handle passwords improperly, both when storing them and when processing them. A passkey cuts through all of this. It is based on public-key cryptography: a private key stays on your device, the site stores the public key, and the proof is a signed answer to a fresh challenge.

Passkeys also help against phishing, where a fake site tricks you into typing your password. With WebAuthn, the standard behind passkeys, your device only offers credentials that were registered on the same website, so a look-alike site simply gets nothing. To unlock the key, you use something you have, your device, plus a fingerprint, a face scan or a PIN. Your fingerprint is not sent over the network the way a password is.

Is the password dead? Not yet. WebAuthn has been a W3C standard since 2019, and Apple, Google and Microsoft all backed passkeys in 2022 and 2023. Even so, most websites that support them still keep passwords around in some capacity. The change is under way, but not finished.