Passkeys and WebAuthn: passwordless authentication, explained and ready for business
The password problem
Passwords are the weak point of almost every system. Users reuse them, attackers steal them through phishing or extract them from breached databases, and even complexity rules do not fix the underlying issue: a shared secret that travels and can be intercepted. For years the answer was to add a second factor; passkeys change the first one instead.
What passkeys are
A passkey is a cryptographic credential that replaces the password. At registration, the user's device generates a key pair: the private key stays on the device, protected by its unlock mechanism (fingerprint, face, PIN), while the public key is handed to the service. To sign in, the device signs a challenge with the private key: no reusable secret is typed or transmitted.
How WebAuthn/FIDO2 works
Passkeys rest on open standards: WebAuthn, defined by the W3C, and FIDO2 from the FIDO Alliance. The browser mediates between the service and the authenticator (the device or a hardware key). The service sends a challenge, the authenticator signs it after verifying the user, and the service validates the signature with the registered public key. All without a shared secret ever leaving the device.
Phishing resistance
The decisive advantage is phishing resistance. A passkey is bound to the origin (the domain) it was created for: the browser will not use it on a different site, however similar. Even if the user lands on a clone page, there is no password to type and hand to the attacker. This closes off the most widespread category of attacks in one move.
How to adopt them in a company
Adoption is best done gradually. You start by offering passkeys as a second factor alongside the password, to let users get comfortable; then you enable passkey-only login while keeping a secure recovery path; finally you reduce reliance on the password. A modern identity platform manages multiple passkeys per user, lost devices and the credential lifecycle.
Limits and fallback
Passkeys do not remove every problem: account recovery, shared devices and scenarios without biometrics all need handling. You always need a secure fallback that does not reintroduce the weaknesses of the password. The good news is that the standards are mature and supported by the major operating systems and browsers, so the technological base is solid.
FAQ
Are passkeys a second factor or a password replacement?
They can be both. At first many companies use them as a phishing-resistant second factor; the goal is to use them as the primary credential, removing the password entirely for that user.
What happens if I lose the device with the passkey?
Passkeys can be synchronised in an encrypted way across the user's devices, or you register more than one. In a company you still need a secure recovery process managed by the identity platform.
Do passkeys work on all browsers and systems?
Support is now broad on recent browsers and operating systems thanks to the WebAuthn and FIDO2 standards. Some edge cases remain (old devices, locked-down environments) where an alternative path is needed.