Passkeys

If you’re tired of remembering complex passwords or worrying about phishing attacks, passkeys offer a simpler, safer alternative. Major platforms like Google, Microsoft, Apple and Yahoo now support passkeys.

 How It Works

Passkeys are built on the Web Authentication standard and use public-key cryptography. When you create a passkey, your device generates a unique pair of cryptographic “keys”:

·        The Public Key: Shared with the website or app you’re using.

·        The Private Key: Stored securely on your device (and never shared).

When you sign in, the website sends a digital “challenge” to your device. Your device uses the private key to sign the challenge and sends it back. Since the website has the matching public key, it can verify your identity without ever seeing your password.

Why Passkeys Are Better

·        Phishing Resistant: Since there is no password to type or steal, hackers can’t trick you into giving it away on a fake website.

·        Less Worry about Data Breaches: If a company’s passkey database is hacked, they only have your public keys, which are useless to attackers without your physical device.

·        Simplicity vs Passwords: You only have to know your account username – which is typically your email address. During account creation you don’t have to abide by complex password rules nor write down or manually save the passkey for the account.

Where Are They Stored?

Most passkeys are stored on your device and synced through your cloud account (like Microsoft Password Manager, Apple/iCloud Keychain, Google Password Manager, or passkey managers such as LastPass or Bitwarden). This means if you get a new computer or device, your passkeys move with you automatically with your cloud account, so you aren’t locked out of your accounts. 

What websites support Passkeys?

Major email providers Google, Microsoft and Yahoo now support passkeys. Many major retailers such as amazon.com, besybuy.com and costco.com also support passkeys. However, banks and brokerages – likely where most of your money is kept – have been slow to adopt passkeys. Here’s a non-comprehensive list of websites that support passkeys: passkeys.directory.

How to set up a passkey for each of your online accounts

1.  Navigate to the website where you want to set up a passkey for future logins — Sign in the way you normal do using your username and password. After signing in you may be prompted to create a passkey. If so, skip to #3.

2.  Go to the account’s profile/security settings — For example, in your Google Account, look for Security > Passkeys.

3.  Click “Create a passkey” — the website will guide you through setup.

4.  Choose where to store the passkey — your device will usually suggest saving it to your platform’s password manager (Google Password Manager, Apple’s iCloud Passwords & Keychain or Windows Hello/Microsoft Password Manager). Which web browser you are using may also affect the option(s) of where to store the passkey. You may also be prompted to create a 6-digit code which is used to save, sync or recover your passkey to/from the cloud – memorize it or write it down!

5.  Verify yourself — Confirm with your device Face ID, Touch ID, or PIN/password to finish creating the passkey.

Can I still use my passkey when I am away from my computer?

Yes, you can still use your passkey while traveling if it is synced across your devices. Passkeys can be accessed on multiple devices, such as your phone or tablet, as long as they are set up to sync with a password manager or cloud service.