What are passkeys... and are they really better than passwords for keeping your money safe online?

Security experts warn that passwords are becoming ‘no longer fit for purpose’ – with passkeys set to be the future for keeping your money and personal data safe online.

In 2024, having a strong password is like riding a bike. Almost everyone knows what they need to do in order to protect themselves online.

The problem is that human nature wins out all too often. Why bother with ‘X*a$86&f’, when ‘password’ is so much easier to remember.

Worryingly, but not surprisingly, the most commonly used password is ‘123456’, according to password management firm NordPass.

The basic advice on how to create an uncrackable password is to opt for a random stream of numbers, capital and lowercase letters and symbols, making them hard to remember.

Belt and braces: Two-factor authentication was created to make passwords more secure

Remembering passwords has been made easier by the advent of password managers, software which stores all your login information in one secure place.

But despite this many still want a better solution, as their lives are still plagued by having to reset passwords on a regular basis.

Luckily, there is a solution that is growing in popularity. Passkeys offer an alternative sign-in method, that cannot be compromised quite so easily.

What is a passkey? 

Passkeys are unique identifiers that are generated by a user’s device, such as a mobile phone, and linked to the website or application they want to log in to.

They can let you sign into an account just by unlocking your phone, which has access to the passkey credential. According to proponents of the technology, they can’t be leaked, guessed or stolen.

The use of fingerprint scanning or facial recognition is what verifies it is you in possession of your device, and allows the passkey to be used.

You don’t need to remember anything to use a passkey, and as it is totally unique it can only be used for one account.

The invention of passkeys seeks to address the problems with passwords which have led to decades of data breaches.

‘Passwords are no longer fit for purpose – they’re easily hacked and put too much onus on the end-user,’ Simon McNally, cyber security expert at defence and security firm Thales, said.

‘Our recent research found that 64 per cent of customers are frustrated with cumbersome password resets, and with human error still the leading cause of data breaches this should be a leading concern for businesses too.

‘Developments in AI and quantum computing, which will put how and what data is used firmly in the spotlight, only further make this a pressing need.’

The idea, according to Google, is that passkeys will replace the need to remember long and complex passwords, as well as removing the need for ‘sticking plaster’ developments such as two-factor authentication, security questions and SMS verification messages.

I think I’ll pass: Simon McNally says passwords are becoming unfit for use

Back in 2022, Google, Microsoft and Apple jointly backed a new sign-in standard, with their goal being a ‘passwordless future’.

More recently, passkeys have been adopted by business such as PayPal, Ebay, Amazon and Shopify.

Passkeys not only remove the need for long and complex passwords, they also provide greater protection against fraudsters, hackers and data breaches.

McNally said: ‘Using cryptographic techniques, passkeys are harder to crack – making them far more secure. They’re also automatically generated and can be safely stored on devices, making it easier for the consumer and eliminating the need to create long, complex passwords or phrases.

‘Finally, passkeys enable greater privacy by granting authentication without handing over sensitive information – reducing the risk of data breaches.’

How widespread are passkeys?

Currently, passkeys are still in their infancy, relative to passwords at least. But the likelihood is that an increasing number of online platforms will adopt the technology, making the most of its cybersecurity benefits.

Matt Cooke, cybersecurity strategist at Proofpoint, said: ‘More recently the use of passkeys has become widely considered to be more secure than passwords, eliminating the need to set unique, secure passwords and the hassle of remembering multiple credentials for different online accounts.

‘However, adoption of passkeys is not going to happen overnight. The more sites that use them the better (and more secure!) things will become for all of us, but the devices we use to access them also need to start talking to each other to really come up with a universal solution for all.’

Passkeys generally rely on biometrics in order to confirm that the correct user is accessing an account. Because of this, devices that do not have access to fingerprint scanners or facial recognition cannot support the technology.

Despite this, more and more mobile devices have this technology, and legacy devices will gradually fall out of use. In the meantime, there is still some way to go before passkeys become widely used, let alone the only available option.

Unfortunately, there are plenty of companies that have yet to adopt passkey technology. However, for those that do, it is simple enough to switch to this method of sign-in.

Simon McNally recommends checking your accounts with companies to see if passkeys are supported, while your devices may also have options to create a passkey.

Searching for this in your device’s settings will allow you to see if your device is supported.