Passkeys Are Finally Killing Passwords

I keep telling people passkeys aren't a gadget — they're the end of a bad idea we've been living with for fifty years. Let me explain what they actually are, and why this time the replacement might stick.

What a passkey actually is

Strip the marketing and it's this: when you register with a service, your device generates a cryptographic key pair.

• The private key never leaves your device. It's stored in secure hardware — the TPM in Windows machines, the Secure Enclave in Apple devices, Android's secure element (Titan M on Pixels).
• The public key is what gets sent to the server.

When you log in, the server sends a challenge, your device signs it with the private key, and the server checks the signature against the public key it stored. That's the whole flow. No password travels anywhere. No password is stored anywhere. There's nothing to steal.

The underlying idea isn't new — it's how SSH keys and TLS certificates have always worked. What passkeys did was make that mechanism usable by normal people, not just engineers comfortable with ssh-keygen.

Why passwords were doomed from the start

The more I study authentication, the more convinced I am that passwords weren't a security solution — they were a UI compromise from 1961 that we never stopped to question. The problems are well documented:

• People reuse them. The average person has well over a hundred accounts and maybe a handful of unique passwords. One database leak becomes a credential-stuffing festival everywhere else.
• Phishing is structurally unbeatable in the password model. A convincing login page takes twenty minutes to build, and the model requires you to give your secret to whoever asks. Awareness training fights human nature and loses.
• Storage keeps failing. Hashing is standard practice, but "standard practice" isn't universal — MD5 still appears, unsalted hashes still appear, and plaintext storage still gets discovered in 2026. Once the database is out, every credential in it is compromised.

Every single one of these problems is structural to passwords. And every single one of them disappears with passkeys — because the credential is bound to the site's domain (your device won't sign a challenge from a lookalike domain), unique per service (nothing to reuse), and never stored server-side (nothing to leak).

How the login actually works

Registration:

1. Your device generates a key pair via the WebAuthn API.
2. The private key goes into secure hardware. It does not leave, ever.
3. The public key is sent to the service and stored.
4. Done — the service never sees your secret, not even as a hash.

Login:

1. The service sends a challenge to your browser.
2. Your OS asks for permission to use the passkey — Face ID, Touch ID, Windows Hello, a PIN.
3. Your device signs the challenge with the private key.
4. The service verifies the signature against the stored public key.

It's under a second, and it's phishing-proof in a way no password plus 2FA combo can be, because the decision to sign happens in trusted hardware that checks which site is asking.

The device-loss question, answered honestly

"Great, so what happens when my phone dies?" It's the first question everyone asks, and it's fair. The answer is sync:

• Apple syncs passkeys across iCloud Keychain, end-to-end encrypted.
• Google syncs them through Google Password Manager.
• Microsoft does the same through Microsoft Authenticator.

Lose your phone and you sign in from another device in your ecosystem; lose everything and you go through your platform account's recovery process. The real current weakness is portability: switch from iPhone to Android and your Apple passkeys don't follow you. The FIDO Alliance is working on cross-platform credential portability, but it's not here yet, and pretending otherwise helps nobody.

What this means if you build software

If you're shipping an app today, passkey support is a rare win that's simultaneously a security upgrade and a UX upgrade:

• No password database to leak, no credential stuffing, no phishing surface.
• No "forgot password" flow, no reset emails, no 2FA codes to manage.
• Login becomes "look at your phone" — faster than typing, and it never forgets.

The implementation reality is that WebAuthn is well documented and libraries like @simplewebauthn handle most of the client and server complexity. The real work is server-side — storing public keys, managing challenges, handling verification — but it's a one-time lift that replaces the password-reset machinery forever.

Where this actually goes

Nobody's pretending passwords vanish overnight. Shared kiosks, older devices, and edge cases keep them around for years. The realistic path is gradual: passkeys alongside passwords, UX nudges pushing people toward them, passwords slowly becoming the fallback rather than the default.

What's different this time isn't that passkeys are more secure — though they are. It's that they're the first authentication technology that's genuinely easier for the person using it than what came before. That's the only way a security upgrade actually wins: when the secure choice stops being the annoying choice.