If you have been using the internet for any length of time, you know the password drill. Create something long and complex, never reuse it, store it in a manager, rotate it every few months, and hope nobody catches it in a breach. Despite years of best practices and billions spent on security awareness, passwords remain the single biggest weakness in online authentication. They get phished, leaked, reused, and brute-forced at a staggering scale.

But something genuinely different is happening now. Passkeys, built on the FIDO2 and WebAuthn standards, are rolling out across every major platform. Google, Apple, and Microsoft have all committed to passkey support, and thousands of websites already accept them. This is not another incremental improvement like adding SMS codes on top of passwords. Passkeys fundamentally change how authentication works, and they eliminate entire categories of attack by design.

Let's break down what passkeys actually are, how they work under the hood, and how to start using them today.

How Passkeys Work at a Technical Level

At their core, passkeys use public-key cryptography. If you have ever set up SSH keys for a server, the concept will feel familiar. When you create a passkey for a website, your device generates a pair of cryptographic keys: a private key and a public key. The private key never leaves your device. The public key gets sent to the website and stored on their server.

When you sign in, the website sends your device a random challenge. Your device signs that challenge with the private key, and the website verifies the signature using the public key it has on file. If the signature checks out, you are authenticated. At no point does a password, secret code, or shared credential travel across the network. There is nothing to intercept, nothing to phish, and nothing stored on the server that an attacker could use to impersonate you.

Device-Bound vs. Synced Passkeys

Early passkey implementations were strictly device-bound, meaning the private key lived on a single hardware device like a YubiKey or a specific phone. Lose the device, lose access. That approach is extremely secure, but it creates real usability problems for everyday users.

The major platforms solved this with synced passkeys. Apple syncs passkeys across your devices through iCloud Keychain, encrypted end-to-end so even Apple cannot read them. Google syncs passkeys through Google Password Manager across Android devices and Chrome. Microsoft is rolling out passkey sync through their authenticator ecosystem. The private key material stays encrypted and protected by your device's secure enclave or TPM chip, but it travels with you across your devices.

Think of synced passkeys like having a copy of your house key in a locked safe at each of your homes. The key exists in multiple places, but it is always behind a lock that only you can open - your fingerprint, face, or device PIN.

Why Passkeys Eliminate Phishing by Design

This is the part that matters most, and it is worth understanding clearly. Passkeys do not just make phishing harder. They make it structurally impossible for the most common attack patterns.

No Shared Secret to Steal

With passwords, both you and the website know the secret (or a hash of it). If an attacker tricks you into typing your password on a fake site, or if they breach the website's database, they have everything they need to log in as you. Passkeys eliminate this entirely. The server only has your public key, which is useless for authentication on its own. Even if every public key on the server gets leaked, attackers cannot use them to sign in.

Domain-Bound Credentials

Here is where the anti-phishing design gets really clever. Every passkey is cryptographically bound to the specific domain it was created for. When you create a passkey for accounts.google.com, your device records that domain as part of the credential. If an attacker sets up a lookalike phishing site at accounts-google.com or google-login.fake.com, your device simply will not offer the passkey. The domain does not match, so the authentication cannot proceed. You do not need to spot the fake URL yourself. Your device handles it automatically.

This is a fundamental shift. Phishing has worked for decades because humans are bad at checking URLs under pressure. Passkeys take that human judgment out of the equation entirely.

FIDO2 and WebAuthn, Explained Simply

You will see the terms FIDO2 and WebAuthn come up a lot when reading about passkeys. Here is what they mean in plain terms.

FIDO2 is the umbrella standard developed by the FIDO Alliance, an industry group that includes Google, Apple, Microsoft, and dozens of other companies. FIDO2 defines how passwordless authentication should work across platforms and devices.

WebAuthn (short for Web Authentication) is the specific web API that browsers use to implement FIDO2. It is the piece that lets a website say "I want to authenticate this user with a passkey" and lets the browser handle the cryptographic handshake with the user's device. WebAuthn is a W3C standard, meaning it is built into Chrome, Safari, Firefox, and Edge natively.

CTAP2 (Client to Authenticator Protocol) is the companion protocol that handles communication between the browser and the authenticator itself, whether that is a built-in fingerprint sensor, a phone's Face ID, or an external security key.

Together, WebAuthn and CTAP2 make up FIDO2. As an end user, you do not need to think about any of this. You just see "Sign in with passkey," tap your fingerprint or glance at your phone, and you are in.

How to Enable Passkeys on Your Accounts

The setup process is straightforward on all three major platforms. Here is a step-by-step walkthrough for each.

Google

  1. Go to myaccount.google.com/signinoptions/passkeys
  2. Sign in with your existing password if prompted
  3. Click "Create a passkey"
  4. Your browser will prompt you to verify with your device's biometric (fingerprint, face, or PIN)
  5. That is it. Next time you sign in, Google will offer the passkey option first

Google also automatically creates passkeys on Android devices running Android 9 or later when you sign in to your Google account.

Apple

  1. Make sure you are running iOS 16+ or macOS Ventura+ with iCloud Keychain enabled
  2. When you sign in or create an account on a site that supports passkeys, Safari will offer to save a passkey
  3. Confirm with Face ID, Touch ID, or your device passcode
  4. The passkey syncs automatically across all your Apple devices signed into the same iCloud account

For your Apple ID itself, go to Settings, tap your name at the top, then Sign-In and Security, and look for the passkey option.

Microsoft

  1. Go to account.microsoft.com/security
  2. Navigate to Advanced security options
  3. Under "Ways to sign in," select "Add a new way to sign in or verify"
  4. Choose the passkey option and follow the prompts to verify with your device
  5. Microsoft supports passkeys through Windows Hello, external security keys, and mobile devices

Auditing Which Accounts Support Passkeys

One of the most common questions people ask is, "Which of my accounts actually support passkeys?" The answer is growing fast. Major sites like Amazon, PayPal, GitHub, Best Buy, Kayak, and many others have added passkey support over the past year.

The best resource for checking is passkeys.directory. It maintains a searchable, community-updated list of websites and apps that support passkeys, along with notes on implementation quality. Bookmark it and check back regularly, because new sites are adding support every week.

As a practical exercise, pull up passkeys.directory and cross-reference it against your password manager. Start enabling passkeys on your most sensitive accounts first: email, banking, cloud storage, and any account that could be used for identity recovery.

For Businesses: Adding WebAuthn to Your Web Apps

If you run a web application and want to support passkeys for your users, the good news is that the tooling has matured significantly. You do not need to implement the WebAuthn protocol from scratch.

JavaScript and Node.js

SimpleWebAuthn is the most popular library for adding WebAuthn support to JavaScript applications. It provides both a server-side package (@simplewebauthn/server) and a browser-side package (@simplewebauthn/browser). The library handles challenge generation, credential registration, and authentication verification with clean, well-documented APIs.

Python

py_webauthn is a solid choice for Python backends. It handles the server-side WebAuthn ceremony, including attestation and assertion verification, and integrates cleanly with Django, Flask, and FastAPI.

Implementation Considerations

When adding passkey support to your application, keep a few things in mind:

Spring Cleaning for Your Credentials

April is a great time to take stock of your digital security. Tax season is winding down, which means phishing campaigns targeting financial accounts are at their peak. Attackers know people are logging into tax prep sites, bank portals, and government services more frequently than usual, and they build convincing fake login pages to capitalize on it.

Use this moment to do a credential spring cleaning:

  1. Enable passkeys everywhere you can. Start with email and financial accounts.
  2. Audit your password manager. Look for reused passwords, weak passwords, and accounts you forgot you had.
  3. Remove old accounts you no longer use. Every dormant account is a potential breach entry point.
  4. Switch from SMS-based two-factor to app-based or passkey-based authentication. SMS codes can be intercepted through SIM swapping attacks.
  5. Check haveibeenpwned.com. See if any of your email addresses have appeared in recent breaches and change those passwords immediately.

Phishing emails pretending to be from the IRS, tax preparation services, or banks spike every spring. Passkeys neutralize the most dangerous part of these attacks. Even if you click a phishing link and land on a convincing fake site, the passkey will not activate because the domain is wrong. That one technical safeguard can save you from a devastating account takeover.

The Bottom Line

Passkeys are not a future concept or an experimental feature. They are here, they work, and they are supported by every major platform and an ever-growing list of websites. They eliminate the biggest weakness in online security by removing passwords from the equation entirely. No shared secrets, no phishable credentials, no password databases to breach.

The transition will take time. Not every site supports passkeys yet, and old habits are hard to break. But every passkey you enable today is one fewer password that can be stolen tomorrow. Start with your most important accounts, check passkeys.directory for compatible services, and treat this spring as the season you finally started leaving passwords behind.