by Shane Coursen with assistance from Gemini
Tired of remembering dozens of complex passwords? Annoyed by those clunky two-factor codes? Get ready, because a new technology called passkeys is here to make your online life both easier and much, much safer.
The Problem with Passwords
For decades, passwords have been our digital keys. But let’s be honest, they’re a pain! We’re told to make them long, unique, and full of weird characters. Then we forget them, write them down, or reuse them (which is a big no-no!). Every time a company gets hacked, our passwords are at risk. Plus, those annoying phishing emails try to trick us into typing our passwords into fake websites.
Enter the Passkey: Your Digital Fingerprint (Sort Of!)
A passkey is a new way to sign into websites and apps without ever typing a password. Imagine logging in with just your fingerprint, face scan, or a simple PIN – that’s essentially what a passkey lets you do. But it’s far more secure than just using a PIN.
Here’s the magic behind it:
- No Shared Secret: Unlike passwords, where you and the website both know the “secret,” a passkey works differently. When you create a passkey for a website, your device (like your phone or computer) generates two unique, super-secret digital keys. One key stays safely locked away on your device (this is the private key). The other key (the public key) is sent to the website.
- Hardware Protected: That private key isn’t just a file on your hard drive. It’s stored in a special, highly secure part of your device’s hardware, like the “Secure Enclave” on an iPhone or a “Trusted Platform Module (TPM)” on a Windows PC. This secure spot is like a vault that even advanced hackers can’t easily break into, even if they infect your computer with malware. The key never leaves this secure vault.
- Login with a Touch (or Glance): When you want to log in, the website asks your device to prove it’s you. Your device then uses that private key to create a unique digital signature for that specific website. To “activate” this signature, your device asks for your fingerprint, face scan, or PIN. Once you confirm, your device sends the signature (not the private key!) to the website, which instantly verifies it using the public key it already has.
- Phishing-Proof: This is a huge win! Because your passkey is uniquely tied to the actual website address, it won’t work on a fake, phishing website. If a scammer tries to trick you, your passkey simply won’t activate, protecting you from common online fraud.
- Easy and Convenient: No more typing! No more remembering complex character strings! Just a quick biometric scan or PIN, and you’re in. Passkeys also sync across your devices, so if you set one up on your phone, you can usually use it to log in on your laptop (and vice-versa).
Better Than Passwords AND Regular MFA
Passkeys aren’t just an alternative to passwords; they’re generally better than most multi-factor authentication (MFA) methods too. While MFA adds a second step (like a code via text), it still starts with a password that can be stolen. Passkeys build that “second step” directly into the login from the start, making it seamless, phishing-resistant, and incredibly secure.
Passkeys are designed to be significantly more secure than passwords and are considered highly resistant to many of the most common types of cyberattacks. However, no technology is completely “un-hackable.” It’s more accurate to say that passkeys are not vulnerable to the same kinds of attacks that passwords are.
Love’em or hate’em, passkeys are probably the future of online security. They offer a simpler, safer, and more convenient way to manage your digital life by finally kicking passwords to the curb. Keep an eye out for them, as more and more websites and apps are starting to offer passkey support!
But what if my computer is older and doesn’t have “Secure Enclave” or a “Trusted Platform Module (TPM)?
No problem! You can still use passkeys. You just have to use a different kind of key, one that you can carry with you. There are two main ways to do this:
- Use a special USB stick: You can buy a small, physical device called a security key that plugs into your computer’s USB port. This little gadget is the secure cabinet. When you set up a passkey, it gets stored safely inside this device. To log in, you just plug it in and tap a button or enter a PIN. Your computer can’t “see” the key itself, so even if it’s infected with a virus, the key stays safe.
- Use your phone: Your modern smartphone is basically a super-secure mini-computer. It has its own built-in secure cabinet. You can set up a passkey on your phone. Then, when you want to log in on your older PC, the website will show a QR code. You just open your phone’s camera, scan the code, and use your face or fingerprint on your phone to approve the login. Your PC never gets to see the passkey—it’s all handled safely on your phone.
So, even if your PC is old and doesn’t have its own built-in security, you don’t miss out on the benefits of passkeys. You just use an external device that acts as the secure vault, keeping your digital keys safe from hackers.