The password, that string of characters you invented years ago, reused everywhere and can never quite remember, is finally being retired by the apps people use most. In its place comes the passkey: a sign-in method built into phones and computers that confirms who you are with a fingerprint, a face scan or a device PIN. Major banking, shopping, travel and social apps now offer passkeys prominently, and many new accounts are created with one by default. The change is less a new gadget than a new habit, and it promises to fix the oldest weakness in online security, which is us.
A passkey works using public-key cryptography, the same mathematics that secures online payments, packaged so that users never see it. When you create one, your device generates a pair of keys: a public key stored by the app, and a private key that never leaves your phone or laptop. Signing in means your device proves it holds the private key, unlocked by your fingerprint or face. Because the private key is tied to the genuine app or website, it simply will not work on a convincing fake, which removes the trick that makes phishing emails so profitable for criminals, as explainers from the BBC have detailed.
How a Passkey Actually Works
The contrast with passwords is stark. A password is a shared secret: you know it, the company stores a version of it, and anyone who steals either copy can use it anywhere it works. Databases of passwords leak constantly, and because people reuse them, one breach unlocks many accounts. A passkey has nothing worth stealing on the company’s side and nothing to type, mistype or give away. There is no secret to forget, either, which matters because forgotten-password resets are themselves a favourite doorway for account takeover attacks, a point security teams have made for years in guidance collected at our technology tips.
Apps are switching now for practical as much as noble reasons. Password sign-ins fail constantly: users mistype, get locked out, abandon purchases and flood support desks with reset requests that are expensive to handle. Early adopters report that passkey sign-ins succeed far more often and complete in a fraction of the time.
Why Apps Are Switching Now
There are honest questions to ask before celebrating. Passkeys sync through your phone or computer account, so the security of that account becomes crucial; someone who controls your cloud account and devices holds a great deal of power. None of these problems is fatal, but they reward a few minutes of preparation: keeping your device account secured, adding a second device where you can, and checking the recovery options on your most important accounts.
For most people the transition is gentler than it sounds. You do not need to hunt through settings menus today; apps will increasingly offer to create a passkey the next time you sign in, and accepting takes seconds. Passwords will linger as a backup for a while, and older devices may not support the new method at all. The sensible approach is to adopt passkeys first where the stakes are highest, your email, banking and primary phone account, since those guard the resets for almost everything else, and let the long tail of minor accounts follow as their apps catch up.
Getting Used to Life Without Passwords
It is worth pausing on how unusual this moment is. Online security advice has for decades meant asking ordinary people to try harder: longer passwords, unique passwords, changing passwords, remembering passwords. Passkeys reverse the direction. The hard work moves into the device and the mathematics, and the human is asked to do something easy and natural, which is to be themselves in front of their own phone. Security that works with human nature, rather than against it, tends to be the security that actually gets used.
The password will not vanish overnight, and for some years the two systems will run side by side, with all the untidiness that implies. But the direction set by the biggest platforms is unmistakable, and each major app that switches makes the remaining holdouts look more dated. When the history of everyday computing is written, the strange thing will not be that passwords disappeared. It will be that for thirty years, the front door of the internet was guarded by things people wrote on sticky notes.
