Passkeys Are More Than Just Password Replacements: How to Use Them Safely

Passwords are often a weak point for an account. We might use the same password across multiple services, enter them on fake sites, or make them too simple to remember. Passkeys are designed to reduce these issues, but that doesn't mean we can stop paying attention to account security.

In simple terms, a passkey is a login credential that uses devices and cryptographic keys, rather than a string of characters that needs to be typed. When logging into a service, we usually just unlock our phone or computer with a PIN, fingerprint, or facial recognition.

This technology is becoming available on many popular accounts, including email services, password managers, and work platforms. Importantly, we need to understand what passkeys protect, what they do not, and how to set them up without locking ourselves out of our accounts.

Why are passkeys harder to phish?

Phishing works by tricking us into giving our login information to the wrong place. For example, we might receive a message claiming to be from our bank, click a link, and then enter our email and password on a fake page.

Passkeys do not work like passwords that can be copied and typed on any site. The device checks the identity of the site before providing proof of login. Therefore, passkeys are designed to be resistant to phishing on fake sites.

According to CISA, FIDO or WebAuthn-based authentication is a widely available form of phishing-resistant authentication. Passkeys are built on this standard. This means that the primary protection is not because passkeys sound modern, but because the login process ties the credentials to the correct site.

Passkeys are not fingerprint photos sent to servers

One common concern is whether our fingerprints or faces are sent to companies when using passkeys. In normal use, biometric data is used locally to unlock the device. Online services receive cryptographic proof that the device has allowed the login, not images of our fingerprints or faces.

Google explains that biometric data for unlocking passkeys remains on the device. However, the details of storage may vary depending on the operating system, browser, and passkey manager provider.

This is where it is important to distinguish passkeys from passwords. Passwords are secrets that are usually sent for verification by the service. Passkeys use a pair of cryptographic keys: one part is stored by the service, while the other important part resides on the device or credential manager.

What can still be a problem?

Passkeys reduce the risk of password theft, but they do not eliminate all security risks. If someone can unlock our phone or computer, they may be able to use accounts already stored on that device. Therefore, screen PINs and device locks remain important.

Another issue is account recovery. When a device is lost, damaged, or changed, we need a way to log back in. Some services can sync passkeys through credential manager accounts, while others may require additional recovery methods.

Do not consider recovery emails, phone numbers, or backup login methods as unimportant. If these pathways are weak, attackers may try to take over accounts through recovery routes even if the primary login uses a passkey.

How to start using passkeys

1. Secure your devices first. Use a screen PIN or password that is not easily guessable. Avoid PINs like birth dates or repeating numbers.
2. Start with the most important accounts. Prioritize your main email, cloud storage accounts, financial accounts, and accounts that serve as recovery hubs for other services.
3. Log in from official apps or sites. Do not create passkeys through links sent via unsolicited messages. Open the app or type the site address manually.
4. Look for the account security menu. This option is usually found under Security, Login, Sign-in options, or Passkeys.
5. Check the registered devices. After creating a passkey, review the list of devices or active sessions. Remove old devices that are no longer in use.
6. Set up at least one recovery method. Ensure that the recovery email is still accessible and that the phone number is no longer linked to the lost device.

Don't rush to disable all other methods

After creating a passkey, some people immediately want to delete passwords, SMS codes, and all recovery methods. This step is not always wise. Each service has different rules, and removing all backup pathways can leave us without access if the device encounters issues.

Start by adding a passkey, then test the login and recovery process. If the service provides multiple passkeys, consider registering backup devices that you actually control. Do not create passkeys on friends' devices, public computers, or office devices that will soon be returned.

For accounts that still require multi-factor authentication, use an authenticator app or a physical security key if available. SMS codes are still better than having no additional protection, but they are weaker than phishing-resistant methods. CISA also encourages the use of phishing-resistant authentication and reducing reliance on SMS whenever possible.

Five-minute checklist for today

• Update the operating system and browser on your phone and computer.
• Enable screen lock with a strong PIN or password.
• Open the security settings of your main email and check if passkeys are available.
• Remove old devices from the list of active sessions.
• Check recovery email and phone number.
• Store recovery information in a safe place, not in public notes or easily forwarded chats.

Passkeys are most useful when understood as one layer of security, not a magic button. They make passwords harder to steal through phishing, but device security, recovery pathways, and vigilance when opening links remain in our hands.

Sources & further reading

• More than a Password — CISA
• Sign in with a passkey instead of a password — Google Account Help
• FIDO Passkeys: Passwordless Authentication — FIDO Alliance

– Rio Yotto @rioyotto