As a long-term fan of Yubikeys, I quickly got curious about this relatively new concept called “passkeys“. Big companies like Apple, Amazon, and Mastercard are nudging their users to adopt passkeys and use them instead of passwords. The “instead of passwords” part really got me curious!

Since forever, passwords have been a part of our online lives for as long as we can remember. But let’s be honest: most of us have a love-hate relationship with them. They’re either too easy to guess or so complex that we forget them entirely. Yes, even if it’s just one master password to a password vault like Bitwarden or LastPass.
And even when we think we’ve got it right, there’s always the lurking fear of being hacked, phished, or caught up in a massive data breach.

Enter passkeys: a next-generation solution that’s not only more secure but also incredibly convenient. Imagine a world where logging in doesn’t require memorizing complex passwords or worrying about their safety. That world is closer than you think.

In this blog post, I’ll share what I learned about passkeys so far. Let’s dig in!

---

What are passkeys?

Passkeys are a modern authentication method designed to replace passwords entirely. At their core, they use cryptographic key pairs to authenticate users securely and effortlessly.

Here’s how they differ from traditional passwords:

• Password: a single string of characters stored on servers, vulnerable to leaks and attacks.
• Passkey: cryptographic keys, where private key never leaves your device, eliminating many traditional vulnerabilities.

Passkeys rely on standards like FIDO2 and WebAuthn and are supported by major tech players, including Apple, Google, and Microsoft, to be used instead of passwords. Their universal design ensures compatibility across platforms, marking them as the next big leap in online security.

Here’s a page by Apple explaining passkey security in their ecosystem: https://support.apple.com/en-us/102195

---

Why are passkeys better than passwords?

Security advantages

• Phishing-resistant: passkeys cannot be guessed, stolen, or tricked out via phishing.
• Server-free storage: private keys are stored only on your device and never transmitted or stored on vulnerable servers.
• No “credential stuffing” attacks: since passkeys are unique to each website, hackers can’t reuse credentials. This attack is all about using the same username-password combination on multiple websites because it worked on one (typically successful when people use the same password on several websites).

Convenience

• No more passwords: no need to memorize complex strings or use password managers.
• Effortless login: authenticate seamlessly using your device’s biometric systems (e.g., Face ID, Touch ID for Apple devices).

Works well with modern devices

• Biometric integration: works natively with Touch ID and Face ID, adding another layer of security.
• Ecosystem integration: fully compatible with Apple devices and synced securely via iCloud.

---

How do passkeys work?

Let’s break down the technical magic behind passkeys. The private-public key pair system:

• Private key: stored securely on your device and never shared.
• Public key: shared with the website or service during registration.

When you log in:

1. The service sends a unique challenge.
2. Your device signs the challenge with the private key.
3. The service verifies the response using the public key.

This process ensures that no sensitive information is ever transmitted, making it inherently secure.

---

How to (quickly!) start using passkeys on the Apple platform

Step 1: Setup

1. Ensure your Apple device is running the latest OS (iOS 18, macOS Sequoia, etc.).
2. Enable iCloud Keychain to sync passkeys across your Apple devices.

Step 2: Use passkeys on websites/apps

1. Visit a website or app that supports passkeys. Services like Amazon AWS, GitHub, Linkedin, and Paypal all have supported them for a while already, so one of these can be a good start.
2. Choose “Sign up” or “Log in with passkey” or something similar – the actual button text will depend on the website and may be hidden under layers of the account menu.
3. Authenticate using Face ID or Touch ID—and you’re in!

Step 3: Manage passkeys

• Access saved passkeys through the Passwords app on your device.
• Use the same passkeys across your Mac, iPhone, and iPad for seamless experiences.

Official guides detailing how to use passkeys on iPhone and Mac

• iOS: https://support.apple.com/guide/iphone/use-passkeys-to-sign-in-to-apps-and-websites-iphf538ea8d0/ios
• MacOS: https://support.apple.com/guide/passwords/passkeys-mchl4af65d1a/mac

Summary

Passwords have served us well, but their limitations are increasingly apparent. Passkeys offer a transformative approach to authentication, combining robust security with unparalleled convenience. Whether you’re a casual user or a tech enthusiast, passkeys are a leap forward in making our digital lives safer and simpler.

It’s time to say goodbye to passwords and hello to a future powered by passkeys.
Give it a try with one of the services you use today − your online security will thank you.

---