Cyber Snapshot - Passkey

Overview

We have all been there: you try to login to an account only to realize you have forgotten your password. This can be a pain, because staying safe online requires unique, complex passwords for all accounts. But what if we told you there is a way to secure your account that does not require you to remember complex passwords? That is exactly what a passkey does. 

Trying to manage unique, complex passwords for all your accounts can be a headache, leading users to revert to reusing old, easy to crack passwords. Passkeys solve both problems by removing the need to remember passwords and by being phishing resistant.

What is a passkey, and how do they work?  

A passkey is a cryptographic key pair consisting of a public and private key. Unlike a password, which is a shared secret transmitted over the internet, a passkey does not transmit any secret information. Simply put, a passkey is a more secure password alternative which is matched to a specific site/service from a device you control without the need to remember a password.

When you set up a passkey, your device will generate a cryptographic pair of keys. The device will share a public key with the corresponding website, while keeping the private key locally on the device used to set up the passkey. This method acts like a built-in multi-factor authentication (MFA) because it uses something you have, the device used to set up the passkey, and something you know or are, like a personal identification number (PIN) or biometric scan for authorization. 

Passkeys offer stronger security than passwords. They are resistant to phishing, even if you already use MFA. This is because, in a typical phishing email, a bad actor creates a fraudulent website to get you to enter your password. This is not possible with a passkey because, first, there is no shared secret, like a password, transmitted over the web. Second, the public key is bound to the original website the passkey was created for, meaning a bad actor would not have access to this without compromising and controlling the website itself. Even if a bad actor is able to obtain the public key, it is not feasible to extrapolate the private key, which is used to access the account.  

Although the use of a passkey may be easier, quicker, and more secure, this does not mean it does not have its own faults. To start, a passkey is not hack proof, but a bad actor would have to gain access to your private key vault. Other common problems of passkeys are limited adoption capabilities, meaning some sites have not adopted the use of passkeys, which should wane as it becomes more widely adopted. Finally, passkey may have an issue with syncing across multiple devices such as your cellphone and laptop.  

If you want to start using passkeys, you have several options. Apple and Android devices support passkeys through iCloud Keychain and Google Password Manager. You can also choose third-party tools like Bitwarden, NordPass, or 1Password. Many websites now accept passkeys for login, including Microsoft, Amazon, Coinbase, Walmart, PayPal, and X.

In summary, passkeys are the next significant evolution in digital security, addressing a fundamental vulnerability in traditional password-based authentication systems. By utilizing asymmetric cryptography, the shared secret is eliminated, significantly limiting the effectiveness of phishing attacks and data breaches.

While challenges like limited adaptation and cross platform synchronization exist, the enhanced security and convince offered by passkeys make them an appealing solution to traditional credential theft.

See below for tips to set up passkeys on your device:

Apple: Use passkeys to sign in to websites and apps. Retrieved January 28, 2026.

Microsoft: Signing in with a passkey. Retrieved January 28, 2026.

Google Developers: Passkeys supported environments. Retrieved January 28, 2026.

February 2, 2026
CS-01-2026