If you’ve noticed more and more sites offering to let you “sign in with a passkey” instead of a password lately, you’re not imagining things. Apple, Google, and Microsoft have all been pushing this technology hard since 2023, and it’s quickly becoming the new standard for how we log into things. Here’s what’s actually going on, and why it matters for your business.
What is a passkey?
A passkey replaces your password with something much harder to steal: a pair of cryptographic keys generated by your device. One half stays locked inside your phone or computer’s secure hardware and never leaves it. The other half gets shared with the website you’re logging into. To sign in, your device proves it has the private half — usually with your fingerprint, face, or device PIN — and that’s it. No password to type, remember, or leak.
Why is this suddenly everywhere?
A few real reasons, not just hype:
- It can’t be phished. A passkey is tied to the actual website’s real address. Even if you’re fooled into visiting a perfect fake login page, your device simply won’t offer up the passkey — it structurally can’t be tricked the way a typed password can.
- There’s nothing to steal in a data breach. Passwords get stored (and sometimes leaked) by every site you use them on. Passkeys don’t work that way — there’s no shared secret sitting in a company’s database for hackers to walk away with.
- It’s actually easier. One tap or glance instead of typing a password and then digging out a text message code.
How does it work across your phone, laptop, and everything else?
This is the part that confuses most people. You don’t create one key and copy it everywhere — the private key is designed to never leave the device it was created on. Instead, it works one of two ways: your key gets securely synced to your other devices through your phone or computer’s built-in password manager (if they’re all signed into the same Apple or Google account, for example), or if you’re on a device that doesn’t have it, you scan a QR code with your phone to approve the login remotely, without the key ever actually moving.
Our recommendation: don’t rely on your browser to manage this
We’d steer you away from relying solely on whatever’s built into Chrome or your phone’s default settings. A dedicated password manager gives you a single place that securely handles passkeys (and passwords) across every device you own — phone, laptop, tablet — regardless of whether they’re all Apple, all Google, or a mix.
We’re a Bitwarden Partner, and it’s what we use and recommend to our own clients: it’s well-regarded in the security industry, works the same way on every platform, and its zero-knowledge design means even Bitwarden itself can’t see what’s in your vault.
If you’d like help getting your business set up with passkeys and a proper password manager, reach out — it’s exactly the kind of thing we help clients with every day.