Simple in concept.
I get it. In those articles, I went into some implementation details that, in all honesty, most people probably don’t care to know about. They ended up distracting from the important stuff.
Fair enough. Let’s see if I can simplify things further and use this opportunity to address some common questions and concerns.
Passkeys made simple
Passkeys are secrets stored on your computer for every account that uses passkeys. They prove you are you by using your fingerprint, face, or PIN to unlock them. This keeps you safe from phishing, hacking, and stolen passwords. You can also use a password vault to share passkeys across devices.
Passkeys, compared
Let’s start by comparing and contrasting the three different “pass-things” we regularly deal with.
- Password: A single word or collection of random characters. “password”, “HelloDolly”, and “iBms7Boi4a8kNQipqCtf” are all examples of passwords that range from poor to strong.
- Passphrase: Passwords made up of multiple words. “Hello Dolly”1, “Correct Horse Battery Staple”, and “use-the-force-Luke” are all examples of passphrases. They’re usually longer than plain passwords and easier to remember.
- Passkeys: A secret placed on your computer that you never see. The “trick”, if you want to call it that, is how and when that secret gets placed on your device in the first place.
Passkeys work on both Windows and Mac computers2, as well as your smartphone. I’ll be referring to computers throughout this article, but all these devices apply.
I’ll also be using Microsoft accounts in my examples, but the concepts apply across the board to any online service that supports passkeys.
Help keep it going by becoming a Patron.
Setting up a passkey
For services that support it, setting up a passkey is pretty much a one-step process:
- Say yes when passkey setup is offered.
Seriously, that’s it. Sometimes you don’t even have to say yes; the system sets it up for you.
There are a couple of things to understand about this.
- It’s offered only after you’ve signed in some other way.
- Every computer you use gets its own passkey for every account. (There’s an exception that I’ll discuss below.) Note that in the message above, it indicates “This will be saved to your Windows device”, meaning the computer on which you are signed in.
What happens when you set up a passkey
The service you’re signing in to stores a complex secret on your computer. Conceptually, that’s it.
The secret is stored securely3 on your computer so it can’t be accessed by anyone else.
The service also keeps track of which computer(s) you’ve set a passkey.
What happens when you use a passkey
In order to access the secret stored on your computer, your computer asks you to confirm you are you. This can take several different forms.
- You may be asked to enter your computer sign-in PIN.
- You may be asked to provide your fingerprint, if you’ve set that up.
- You may be asked to pass facial recognition, if you’ve set that up.
- You may be asked to provide the computer (not the account) sign-in password.
Essentially, anything you can use to unlock or sign in to your computer can be required at any time to unlock access to your passkeys. If you can’t provide any of those, your passkeys remain securely locked.
When you sign in to an online service using a passkey:
- You unlock passkey access on your computer,
- The computer provides the secret to the online service
- The online service recognizes that as authorization to access your account.
All you do is unlock your passkey, much like you unlock your computer.
Related
What If My Passkey Doesn’t Work or I Lose the Device It’s On?
Passkeys are supposed to make signing in easier and safer, but what happens when it stops working or your device is gone? I'll show you what to do if your passkey fails or is lost and a technique that makes passkeys work everywhere.#190493
What happens when you lose your device
This is generally more of a concern with mobile devices, but it could be a stolen computer as well.
The only way passkeys could be useful to a thief or someone who finds your device is if they’re able to unlock it. If they can’t unlock the device, then they can’t access your passkeys.
This has been true of password vaults for years. Heck, it’s true for anything accessible on any device. It’s why we lock or auto-lock the devices to begin with.
Of course, you should consider remote-wiping a lost or stolen device. Passkeys, however, have an additional safety net.
How to revoke a passkey
Passkeys are:
- Unique to each device on which you sign in.
- Unique to each account you sign in to on that device.
You might have a passkey on computer A for your Microsoft account and a different passkey on computer B for your Microsoft account.
What happens if you lose computer A?
On computer B (or any other device you can sign in with), you sign in to your Microsoft account, go to Security settings, and in “Manage how I sign in”, you revoke the passkey assigned to computer A.
Once you remove the passkey from the account, the passkey stored on the missing machine will no longer work.
Your online account keeps a list of all passkeys that can be used to sign in. You can remove any of them at any time for any reason.
How passkeys are more secure than passwords
Passkeys protect you from the most common ways passwords are compromised. That’s why eventually, passwords will become a thing of the past.
| Compromise | Impact using passkeys | Impact using passwords |
| Data breach | No impact. Nothing in a data breach can be used outside of the original service. | Low impact unless the breached service has poor security. |
| Phishing | No impact. Passkeys cannot be phished. | High impact when you hand over your password to a hacker. |
| Malware/keylogger | No impact. There’s nothing secure to type or log. | High impact, as entering your password in any way can cause it to be captured. |
| Lost device | Low impact. Passkeys are protected by your device-unlock process and can be revoked remotely. | Moderate impact, depending on how you store your passwords. |
| Reuse | No impact. Passkeys are unique to each device and each account. There is no reuse. | High impact. Using the same password for multiple accounts is a common way accounts get compromised. |
| Brute force attack | No impact. While technically brute-force is possible, the amount of time required is so ludicrously long (eons) that it’s impractical. | Moderate impact. Poor password choice can often be easily brute-forced, as can poor storage techniques on the part of an online service. |
How passkeys are more secure than passwords even if you still have a password
One of the most common pushbacks I get is, “If I can still sign in with a password, what good is a passkey?”
Even if your account still has a password, by using a passkey you are bypassing any phishing attempts and keyloggers. Regularly using a passkey dramatically reduces the possibility that your password would ever be accidentally exposed.
In addition, it enables you to set long, strong, uncrackable passwords like “RPyDytZ6NaDwY9nzY2Wk”. You’ll only have to enter it the first time you sign in to a device on which you then set a passkey.
At some point, passwords as we know them are likely to go away completely.
Passkeys and password vaults
Many password vaults can act as a repository of your passkeys.
Related
Is Syncing Passkeys Across Devices Safe?
Passkeys promise more security and less hassle, but is syncing them across devices safe? Learn how password managers handle passkeys and what happens if a device is stolen.#185228
When you use a password vault to store passkeys, each passkey you set up for an account is immediately available across all the computers on which you use that password vault. You no longer store a passkey on every device.
The online service sees your password vault as if it were a single computer. The downside is that you can’t revoke passkeys per device. You can revoke the passkey kept in the password vault, but this affects all computers on which you use that password vault. You’d need to set up a new passkey.
Passkeys and two-factor authentication
Passkeys are not two-factor authentication (2FA). Think of them more as a direct replacement for passwords.
This can get confusing, because some of the techniques we use for 2FA can also be used as alternate sign-in methods when setting a passkey. For example, the first time you sign in to an account on a new device, you might need to respond to an email that contains a link or a code. That could be either single-factor authentication for a passwordless account or for 2FA.
If your account has two-factor enabled, then your passkey login flow typically looks like this.
- The first time you sign into a machine
- You sign in another way (password, texted or emailed code, confirmation on some other already signed-in device, etc.).
- You provide the second factor (key, authenticator app, texted or emailed code, etc.)
- You set up a passkey
- Subsequent sign-ins to the same account on that same machine
- You unlock the passkey by providing your device unlock PIN, fingerprint, or facial recognition.
A brief note about cryptography
In a previous article on passkeys, I spent a fair amount of time on public key cryptography. While the specifics aren’t required to understand or use passkeys, it’s important to understand at least three of the benefits.
- You can’t steal a passkey and use it somewhere else. Encryption ensures that a passkey is valid only on the computer on which it was issued.
- You can’t steal the online service’s information about a passkey and expect that to work anywhere else. Encryption ensures that the information stored at the online service to validate your passkey is useless anywhere else.
- You can’t perform a “man-in-the-middle” attack attempting to impersonate passkey usage. Encryption ensures that passkey information can be exchanged only between your computer and the service that issued it.
This eliminates almost all concerns about data theft, hacking, and breaches.
Do this
The reality is that passkeys are coming. They are universally regarded as significantly more secure than passwords by the security experts who live and breathe this stuff. Hopefully, now you understand them a little better, but please don’t let any lack of understanding stop you from using them wherever they are available.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Podcast audio
Footnotes & References
1: Technically, the password example “HelloDolly” is also a passphrase. Generally, they are distinguished by how the words are separated, though it’s not a hard-and-fast rule.
3: This is one of the uses of a TPM on PCs: it provides exceptionally secure storage for things like this. Other devices use other forms of highly secure credential storage.
Is this Password Better than your original password protection?
Read the article. It answers your question.
One thing bugs me about this and your other videos on the subject of Passkeys. You never address the now unnecessary password within the password manager that may or may not contain the associated passkey. Should the password be deleted only if the passkey is within the password manager? What if I don’t use a password manager and throw away that post-it note on my monitor that has all my usernames and passwords, now that they all use passkeys?
Is there a situation where I should retain my passwords for those accounts that now have passkeys? What if I have only one device that is now stolen and I never set up 2FA on that (or any) account and don’t utilize a common username (like my email).
As always, I appreciate your expertise and guidance, Leo (and Team Leo). Thanks.
Keep the password wherever you keep it. It may be one of the “other ways to login” when you set up a passkey on a new device.
Only when the service itself stops using passwords does it make sense to delete your own, now no longer relevant, password.
Hi Leo, I found your video very helpful and it made me feel more confident about passkeys. What I find overwhelmingly confusing is the mix of options that have emerged for these types of protection. I use a good password manager (bitwarden) and I use 2FA for sensitive accounts and I include Yubikeys as a 2FA option usually. I also have some passkeys on my windows laptop. The problem is I have no idea how these interact and which apply to what and I don’t really know how to find out. You mention that windows keeps a list of them and also that they can be placed in the password manager. Can that be done after they have already been set up in Windows. I am sure a lot of people have this type of problem, how do we unscramble the mix of protections we have built up even if, as is true for me, we have worked quite hard to try to get it right.
All the best, Andrew
I have a good understanding of Public Key Cryptography but not the actual message flow of passkeys. I assume there is some challenge/response/signature sequence that occurs. How does that prevent man-in-the-middle arracks?
The passkey on your device is secure because it’s cryptographically bound to the website’s origin. Your device will only use the private key when the browser proves it’s connected to that origin over a valid TLS connection. A man‑in‑the‑middle can’t fake that, and the challenge/response exchange prevents replay attacks, so all they ever see is useless encrypted gibberish.
I’m setting up my computers as dual boot Windows and Linux. Is the passkey available and the same either way I boot? Thanks.
If you dual boot, you will have to set up a separate passkey on each platform as the sites you access see them as different devices. Even though it’s the same physical machine, the two operating systems have different cryptographic stacks, different secure storage, different device identifiers, and cannot access each other’s passkey storage.
So from the website’s perspective Windows is one device and Linux is a completely separate device.
Hello Leo,
i find your videos very informative and thank you for taking the time to post them.
I am curious as to the effect of updating the OS, hdd-ssd, memory etc has on passkeys.
Thank you
Paul