What Are Passkeys? All Treat, No Trick!
Last week, we talked about the scariest thing in your business being a reused password. This week, I have good news. You may be able to skip the password altogether. Yes, really.
Have you heard of a Passkey? Do you use them? A Passkey is a newer, albeit fancier, way of proving you're you, and it's the rare security upgrade that is actually easier than its predecessor. That’s why I said, “All Treat, No Trick!”
Here's the simple version of how it works:
When you create a passkey, your device makes a matched pair of digital keys.
One stays locked on your device and never leaves it.
The other goes to the website.
When you log in, your device uses its key to prove it's really you.
There's no secret for a criminal to steal from the website, because the website never holds your secret.
Why passkeys are safer than passwords
There’s nothing to reuse: Every passkey is unique to one site, so the "same password on five accounts" problem can't happen. It’s like redundancy without the risks of actual redundancy!
Passkeys don’t have anything to guess or steal: There's no actual password sitting on a server vulnerable and waiting to be leaked.
They are hard to phish: A fake website can trick you into typing a password. Have you been there? A passkey only works on the real site it was created for, which is a relief because phishing attempts are getting harder to spot every day.
Passkeys protect your logins from phishing, but unfortunately they don't stop a criminal from sending emails that pretend to be you and that one can hurt your reputation. It’s also a different fix. An email setting called DMARC helps prove an email really came from your business. Check out this easy tool to see if your domain is set up correctly! No email follow-ups or sales pitches, just a good old-fashioned test! Try it below.
Passkeys are faster: One tap or glance, and you're in. I'll take less typing any day. How about you?
Worried about sharing biometric data? You’re not alone. Let’s unpack that together.
Are passkeys safe? What happens to your fingerprint or face data?
A lot of people hear "log in with your fingerprint or face" and immediately get nervous, which is completely fair. Your fingerprint isn't something you can change if it leaks, so who gets a copy? The reassuring answer is nobody does.
Here's what actually happens:
Your biometric input never leaves your device: Your fingerprint or face is used only to unlock the passkey on your phone or computer. It's a local check, like a key turning in a lock.
Websites never see it: The site receives proof that you unlocked your passkey, not your fingerprint, your face scan, or any image of either. A company can't leak what it never receives.
Your device stores it securely: Modern phones and computers keep biometric data in a protected part of the hardware, separate from traditional apps and websites.
Your employer doesn't collect it either: If your team uses passkeys, the business isn't gathering or storing employees' fingerprints or faces.
Still not comfortable with biometrics? You still have options. A passkey doesn't require a fingerprint or face. You can unlock it with your device PIN or a swipe pattern instead. You still get the benefits of nothing to reuse and nothing to phish, just without the biometric step.
Please remember, a passkey is only as protected as the device it lives on. Using a strong PIN, keeping your device updated, and turning on a screen lock are all still viable ways to increase security. If someone gets your unlocked phone and knows your PIN, they can get in, so protecting your device is part of the deal.
Have a question or want a hand getting started? Get in touch here, and I’ll be happy to give you the best guidance for your unique situation.
Missed last week? Read The Scariest Thing in Your Business is a Reused Password.
About the author: Kevin Dutkiewicz is the founder of TechBrews, providing practical IT and cybersecurity guidance to small businesses in Stow and across Northeast Ohio.