Passkeys and passwordless login: why users like them and what switching takes

Passwords are the weakest part of most applications. People reuse them, forget them and type them into convincing fake login pages. Password reset emails are among the most common support requests for many products. Passkeys are the industry’s answer, backed by Apple, Google, Microsoft and the FIDO Alliance, and they are now supported across all major operating systems and browsers.

This article explains what passkeys are, why users and security teams both like them, and what it takes to add them to your product.

How passkeys work

A passkey is a credential based on public-key cryptography, built on the FIDO2 and WebAuthn standards. When a user creates a passkey for your site, their device generates a pair of keys:

• A private key, which stays protected on the user’s device or in their password manager and never leaves it.
• A public key, which is sent to your server and stored with the user’s account.

To sign in, your server sends a random challenge. The user’s device asks them to confirm with their fingerprint, face or device PIN, then signs the challenge with the private key. Your server checks the signature with the public key. No secret ever travels over the network or sits in your database.

Why passkeys are more secure

• Phishing-resistant: each passkey is bound to your website’s domain, so it simply will not work on a lookalike site.
• Nothing to leak: if your database is breached, attackers get public keys, which are useless for signing in.
• No reuse: every passkey is unique to one site and one account.
• Built-in second factor: possession of the device plus a biometric or PIN check, in a single step.

Why users like them

For users, signing in with a passkey feels like unlocking their phone. There is nothing to remember or type, no codes to copy from a text message and no reset emails. Passkeys created on Apple devices sync through iCloud Keychain, those on Android and Chrome sync through Google Password Manager, and third-party managers such as 1Password and Bitwarden also store and sync passkeys. Users can also sign in on a device without their passkey by scanning a QR code with their phone.

What implementation involves

Adding passkeys means implementing two WebAuthn flows, which the browser’s Web Authentication API and well-maintained libraries make manageable:

1. Registration: your server creates options including a challenge and your domain; the browser asks the user to create a passkey; your server verifies the response and stores the credential ID and public key.
2. Authentication: your server issues a new challenge; the browser asks the user to verify; your server checks the signature and signs the user in.

Libraries such as SimpleWebAuthn for JavaScript and TypeScript handle the cryptographic verification and edge cases. Most authentication services, including Auth0, Clerk, Firebase and Supabase-compatible providers, also offer passkey support, which can be the fastest route if you already use one.

A safe rollout plan

1. Keep your existing login working. Add passkeys as an option, not a replacement, at first.
2. After a successful sign-in, invite users to create a passkey for next time, with a one-line explanation of the benefit.
3. Let users manage passkeys in their account settings: view, rename and remove them, and add more than one.
4. Use autofill-assisted sign-in on your login page so passkey users get the fastest path.
5. Measure adoption, sign-in success rates and support tickets.
6. Once most active users have passkeys, consider making them the default and passwords the fallback.

Account recovery still matters

Passkeys remove passwords, not the need for recovery. Plan for users who lose all their devices or change platforms:

• Encourage users to register passkeys on more than one device or in a cross-platform password manager.
• Offer recovery through a verified email address or phone number, with additional checks for high-value accounts.
• Notify users by email whenever a passkey is added or removed.
• Make recovery steps strong enough that they do not become the easy way in for attackers.

Passwords, codes and passkeys compared

Things to watch for

• Shared devices: users on a shared family tablet may not want a synced passkey; keep alternatives available.
• Workplace policies: some companies restrict which authenticators employees may use.
• Clear wording: many users still do not know the word “passkey”; say “sign in with your fingerprint or face” alongside it.
• Testing: check registration and sign-in on iOS, Android, Windows and macOS with the main browsers.

For most products, passkeys reduce support requests, cut account takeover risk and make signing in faster. If you would like to add passkeys to an existing application, we can design a rollout that keeps every user able to sign in throughout.