Passkeys: The Login That Follows You to Every Device (And Can't Be Phished)
TL;DR:
A passkey replaces your password with something your device already checks all day -- your face, your fingerprint, your PIN.
Think of it like a house key that copies itself into every pocket you own. New jacket, it is already there. New phone, it shows up before you finish unboxing. Walk up to a door that only looks like yours, and it does not turn.
On a good day, nobody types a password, resets one, or writes one on a sticky note. On a bad day -- the one passwords have handed us for thirty years -- somebody types theirs into a page that looks exactly right. Passkeys make that bad day stop working, because there is nothing to type.
Beyond the Basics:
Here's the shift: a passkey is a FIDO2 credential that syncs, and that one change is what finally made passwordless practical.
Hardware security keys solved phishing years ago. They also created a support problem. Lose the key and you lose the account, so every deployment came with spare keys, an enrollment process, a recovery process, and a shipping-to-every-remote-employee logistics problem. Passkeys keep the cryptography and drop the logistics.
- Your device creates a key pair for one specific site. The private half stays on the device, guarded by your biometric or PIN. The site only ever stores the public half.
- The private half syncs through your platform account. iCloud Keychain, Google Password Manager, or Microsoft's passkey store replicates it, encrypted, to your other devices. New laptop, same passkey.
- The credential is welded to the site's origin. Point it at a lookalike domain and the handshake never starts. Your device will not sign a challenge for a site that is not the one it enrolled with.
- Signing in is a signature, not a secret. The site sends a random challenge, your device signs it, and you are in. Nothing reusable ever crosses the network.
In a Microsoft environment this runs through Entra ID. You can enforce phishing-resistant sign-in with Conditional Access, allow passkeys in the Authenticator app, and start retiring passwords for the accounts that get targeted most.
The catch is recovery. A synced passkey is only as protected as the platform account holding it, so that account needs its own strong second factor. And syncing is what some regulated environments explicitly do not want -- for those, device-bound passkeys on hardware keys still exist, logistics and all. Skip the recovery planning and you have not removed the password problem, you have moved it somewhere with fewer eyes on it.