In this article · 6 sections
Passwords get reused, guessed and phished. Passkeys are a newer way to sign in that uses your phone or computer's fingerprint, face or screen lock instead. Google, Microsoft, Apple, WhatsApp, Amazon and many other services now support them, and they are one of the easiest security upgrades for a small business.
How passkeys work (simply)
- When you create a passkey, your device makes a pair of cryptographic keys
- The public key is stored by the website; the private key never leaves your device (or your password manager / cloud keychain)
- To sign in, you unlock with fingerprint, face or PIN, and your device proves it holds the private key
- There is no password to type, so there's nothing to phish or leak
Why they're safer than passwords
- Phishing-resistant: a passkey only works on the real website domain, so a fake login page can't use it
- No reuse: each site gets its own unique key
- Nothing to leak: a server breach exposes only public keys, which are useless to attackers
- Faster: one touch instead of password + OTP
Where to start
- Google account / Gmail / Workspace: add a passkey in security settings
- Microsoft accounts
- WhatsApp (on supported phones)
- Amazon, PayPal, GitHub and other services you use for business
- Password managers like Bitwarden or 1Password can store and sync passkeys. See best password managers for business
Things to plan for
- Lost phone: keep a second passkey (laptop, another phone) or a backup method so you can't get locked out
- Shared accounts: passkeys work best with individual accounts; avoid sharing one login among staff
- Old devices: very old phones or browsers may not support passkeys yet
- Keep 2FA on accounts that don't support passkeys. See two-factor authentication
Passkeys for your website
If you run a portal where customers or agents log in, adding passkey (WebAuthn) support is increasingly practical with modern libraries. It reduces password-reset requests and account takeovers.
FAQs
Does the website get my fingerprint?
No. Your biometric stays on your device; it only unlocks the key.
Can I still use a password if needed?
Many services keep a password or recovery option as a fallback. Make sure that fallback is strong too.
Was this article helpful?
Your answer helps us improve our guides