Passkeys Are Showing Up Everywhere — Here’s What You Should Know
You may have noticed a new login option appearing on websites and apps you use every day—Amazon, QuickBooks, PayPal, and others. It’s called a passkey, and while it may sound like just another buzzword in the ever-evolving world of cybersecurity, it’s actually part of a major shift in how we access our digital accounts.
There’s a lot happening around passkeys right now, and whether you’ve already used one or are just hearing the term for the first time, it’s worth understanding what they are, how they work, and why so many companies are adopting them.
What Is a Passkey?
A passkey is a modern alternative to the traditional username and password. Instead of manually entering credentials, passkeys use a cryptographic system involving a public key (stored by the app or website) and a private key (securely stored on your device). When you authenticate—often using biometrics like Face ID or a fingerprint—your device confirms your identity and uses the private key to “sign” you in.
This method stems from FIDO (Fast Identity Online) authentication standards, developed to reduce reliance on passwords and improve security. While FIDO technology has been
around for some time, adoption only started accelerating when the term “passkeys” was introduced—making the concept more accessible and easier to understand.
Why Are Passkeys Gaining Momentum?
The rise of passkeys is largely driven by the shortcomings of passwords. Passwords are often reused, easy to guess, or stored insecurely, making them a frequent target for phishing and data breaches. Passkeys, by contrast:
Can’t be guessed or shared
Don’t rely on server-side storage of secrets
Are resistant to phishing
Eliminate the need to remember or manage complex passwords
Early results are promising. Some organizations have reported a 10% improvement in sign-in success rates and a 70% reduction in account takeovers when switching to passkeys. In regulated industries like healthcare, passkeys—with device-level authentication and IP restrictions—can even support compliance standards like HIPAA or CMMC Level 3 when configured appropriately.
Where Can You Use Passkeys?
Passkeys are now supported by a growing list of major platforms and services including Google, Amazon, TikTok, eBay, Kayak, and Best Buy. Some password managers, such as 1Password and Bitwarden, also support passkey creation and storage, allowing for easier adoption across different devices and ecosystems.
However, implementation is still in progress across many services. Some platforms only allow passkey creation after traditional login, while others—like QuickBooks—have faced usability issues. For example, users have reported challenges with browser compatibility, CAPTCHA barriers, or fallback authentication requirements that still rely on passwords or two-factor authentication.
Are Passkeys Really More Secure?
In many ways, yes—but with important caveats.
Passkeys are considered more secure than passwords due to their cryptographic structure and the fact that credentials are never transmitted or stored on central servers. They’re also inherently resistant to common attack vectors like phishing and brute force attacks.
However, passkeys are not a silver bullet. PCMag noted that security expert Trevor Hilligoss of SpyCloud has observed that attackers are increasingly targeting session cookies—temporary data that validates a logged-in session. If a criminal steals a user’s session cookie (often via malware), they can bypass the need for login credentials altogether. In such cases, even the strongest authentication system, including passkeys, becomes irrelevant unless broader security measures are in place.
Website owners and IT administrators must take steps to harden their infrastructure against session hijacking, enforce short session expiration times, and limit access by device or IP when possible.
Are Passkeys Quantum-Ready?
Not yet—but neither are passwords.
Quantum computing poses a potential threat to many of today’s cryptographic methods, including those behind both passwords and passkeys. As of now, passkeys are not considered quantum-resistant, and neither are the encryption standards used to protect traditional login systems. That said, the cybersecurity industry is aware of this challenge, and future iterations of passkey infrastructure may incorporate post-quantum cryptography as standards evolve. In the meantime, current cryptographic systems still offer significant protection against today’s threats—and for most users and organizations, adopting passkeys still represents a meaningful improvement in security.
What’s Next?
Passkeys aren’t yet universal—some industries and smaller websites will take time to catch up. But with major platforms already adopting the standard and early results pointing to better security and smoother logins, it’s clear they represent a meaningful shift.
For now, users can explore passkeys where available while still relying on password managers and multi-factor authentication as needed. Whether passkeys fully replace passwords remains to be seen, but the transition is well underway—and as support grows, they may become the new default for logging in. Hopefully, one day, even in a quantum-secure world.
