Passkeys: the end of passwords, explained plainly
If you have been offered “sign in with a passkey” and clicked “not now”, this is the article that should change your mind. Passkeys are the first replacement for passwords that is both more secure and easier to use, and for a small business they close off the attack that causes the most damage: someone tricking you into typing your password into a fake page.
What a passkey actually is
A passkey is a pair of cryptographic keys. One half, the public key, is stored by the website. The other half, the private key, stays on your phone, laptop or password manager and never leaves it. When you sign in, your device proves it holds the private key, and you approve that with your face, fingerprint or device PIN.
Two properties follow from that, and they are the whole point:
- There is nothing to steal from the website. A breach of the site's database leaks public keys, which are useless to an attacker.
- It cannot be phished. A passkey is tied to the real website's domain. On a convincing fake login page, your device simply has no passkey to offer. You cannot be tricked into handing over something you never type.
This is no longer early-adopter territory
Apple, Google and Microsoft all support passkeys across their devices and sync them through their own accounts, and most password managers now store them too. Microsoft made new consumer accounts passwordless by default in 2025. The FIDO Alliance, the industry body behind the standard, estimated in its May 2026 report that around five billion passkeys are now in use.
Which accounts to switch first
Not all accounts are equal. Start with the ones that unlock everything else:
- Your email. Whoever controls it can reset every other password you have.
- Your domain registrar and DNS. Losing these means losing your website and your email at once — see locking down your domain.
- Banking and payments. Where offered.
- Your website or store admin, and anything with customer data in it.
- Social accounts that carry your business name — a hijacked page is a reputational problem as well as a security one.
The one thing to plan for: losing the device
The honest weak spot is recovery. If your passkeys live only on one phone and that phone goes in a river, you need another way in. Before you rely on passkeys, make sure that:
- they sync to an account you control (your Apple, Google or password-manager account), or you register a second device or a hardware security key as a backup;
- recovery codes for critical accounts are stored somewhere offline;
- shared business accounts are not tied to one person's personal phone. When that person leaves, the passkey leaves with them.
What about your own website?
If customers log in to your site, passkeys will become an expected option over the next few years. Do not build this yourself: authentication is exactly where home-made code goes wrong. The major store platforms and identity services are adding passkey support, and the right move is to switch it on when your platform offers it.
Passkeys sit alongside the other basics — updates, backups, multi-factor authentication — covered in what changed in Cyber Essentials and the three attacks that actually hit small businesses. Switching your email to a passkey this week is the single most useful thing on this page.
Sources
Researched, written and published by Aftab Ahmad, owner of Seven Layers.