Passkeys: Signing In Without Passwords
Where you are: Unit IV — Authentication: Passwords, Hashes and Beyond · Lesson 4.6 · This topic is new in the 2026 edition of the course. It extends Dr. Al-Doori's password chapters to the sign-in method now recommended first wherever it is offered.
What you'll be able to do
Explain why passkeys provide phishing-resistant authentication (the credential is cryptographically bound to the legitimate service/domain), set one up, and recognize the risks that remain.
- Describe in plain terms what a passkey is and how you use one.
- Create a passkey on an account that offers it, and know what happens if you lose your phone.
- Explain what a passkey protects against and what still needs your attention.
What a passkey is
A passkey is a way to sign in without typing a password. When you create one for a website, your device makes a matching pair of digital keys for that site:
- The private key stays with you, on your device or in your password manager, and is never sent to the website.
- The public key is given to the website. It is not a secret.
When you sign in, your device uses the private key to prove to the website that it holds the matching half, after you unlock it in the usual way: your face, fingerprint or device PIN. According to the FIDO Alliance, the industry body behind passkeys, your fingerprint or face scan never leaves your device; it only unlocks the key stored there.
For you, the experience is simple: choose the account, look at your phone or touch the sensor, and you are in. There is nothing to remember and nothing to type.
Why passkeys resist phishing
Passkeys provide phishing-resistant authentication because the credential is cryptographically bound to the legitimate service/domain. When you created the passkey, it was tied to the genuine site's address. Your device will offer it only to that address. A look-alike site (Lesson 2.3) is a different address, so it receives nothing it can use, and there is no code for you to read out or type into a fake page.
Compare that with the methods in Lesson 4.5. A password or a one-time code can be typed into a convincing fake page by a person who is rushed or fooled. With a passkey, the check is made by your device, not by your eyes.
The UK's National Cyber Security Centre (NCSC) says passkeys are at least as secure as, and generally more secure than, a password combined with two-step verification, and that signing in is often much faster.
What passkeys do not fix
Phishing resistance is a big step, but it does not make an account invulnerable. Three risks remain:
- Account recovery is a separate path. If the account can still be reset by email or a text-message code, a criminal may attack that route instead of the passkey. Lesson 4.7 shows you how to review it.
- A compromised device creates other risks. Malware on your device can steal the session cookies that keep you signed in (Lesson 4.2), and someone who has your unlocked phone, or knows its PIN, may get in without needing to phish anything. Keep devices updated and use a strong screen lock.
- A compromised account creates other risks. Synced passkeys are protected by the account that stores them, such as your phone's platform account or your password manager. Protect that account with a strong passphrase and the strongest MFA it offers.
Synced or device-bound, and losing your phone
Passkeys come in two forms:
- Synced passkeys are stored by a credential manager (built into your phone or computer, or a password manager) and backed up across your devices.
- Device-bound passkeys live on a single piece of hardware, such as a security key, and are never copied.
If you lose your phone: synced passkeys are restored from the credential manager's backup when you sign in to it on a replacement device. A device-bound passkey on a lost security key cannot be restored, so you need another way into the account, such as a second key or another sign-in method. Either way, make sure each important account has a backup method you can use.
Privacy note: do this check privately on your own device. Never write down, share, upload or submit real passwords, recovery codes, MFA secrets or QR codes, account names, email addresses, phone numbers, home IP addresses, router credentials, screenshots of your accounts, or private messages. If anything is asked for, it is only a completion confirmation, redacted observations, a risk level and your action plan.
Activity: create a passkey
Work privately on your own device.
- Choose one important account that offers passkeys. The option usually appears in the account's security or sign-in settings.
- Follow the steps to create a passkey, and unlock with your face, fingerprint or device PIN when asked.
- Sign out, then sign back in using the passkey to check that it works.
- Note privately where the passkey is stored (which device or manager) and whether it is synced.
- Keep your existing sign-in and recovery methods for now, and check them in Lesson 4.7.
To record completion, note only: passkey created (yes or no), synced or device-bound, and your next account to try.
Real-World Example
Passkeys are already the default at some of the largest services. In October 2023, Google made passkeys the default sign-in option for personal Google accounts. In May 2025, Microsoft announced that new Microsoft accounts would be "passwordless by default", and reported from its own internal figures that passkey sign-ins succeeded about 98% of the time, compared with about 32% for passwords.
Notice the second number. Passkeys are not only about security: they also remove the forgotten passwords and mistyped codes that make signing in frustrating.
Why This Matters in 2026
In April 2026 the NCSC announced that passkeys should be consumers' first choice for signing in wherever they are offered. Where they are not offered, its advice is a strong, unique password with two-step verification, which is exactly the routine from Lessons 4.3 to 4.5.
That makes passkeys the top of the ladder you have been climbing in this unit. Dr. Al-Doori's book teaches how passwords work and how to handle them wisely; passkeys build on that foundation by removing the shared secret that phishing tries to steal. Guidance in this area is changing quickly, so use passkeys wherever an account offers them and keep your password skills for everywhere else.
Watch: What is a passkey — and is it the future of online security? (BBC News)
This short news report shows why major companies are moving to passkeys, and it stays honest about their limits.
As you watch, notice:
- The door analogy: a password is like a code anyone can type in, while a passkey works more like a key card that checks both you and your device.
- What the ethical hacker interviewed says about how people really create passwords: predictable seasonal choices and the same password changed only slightly from one site to the next.
- The reporter's admission that setting up a passkey is a little more hassle than a password at first, and his closing reminder that no system will ever be fully hacker-proof.
The video reinforces what you just read — the lesson is complete without it.
What Would You Do?
You normally sign in to your email with a passkey. Today a message says your mailbox is nearly full and links to a page that looks exactly like your email provider. Your device does not offer your passkey, and the page asks you to type your password instead.
What would you do? Decide, then check the note after the Knowledge Check.
Knowledge Check
You lose the phone that holds your synced passkeys. What is the most sensible next step?
A friend says: now that I use passkeys, nobody can ever get into my accounts. What is the most accurate reply?
Answers explained
- Question 1 — b is right. Synced passkeys are backed up by your credential manager, so signing in to it on another device restores them, and your backup methods cover any gaps. a is unnecessary and would lose your history. c gives up the protection passkeys offer. d leaves you unable to act if someone else has the phone; deal with it promptly.
- Question 2 — d is right. Passkeys provide phishing-resistant authentication because the credential is bound to the genuine site, but recovery routes, device compromise and the account that stores your passkeys still need protecting. a overstates it: no method makes an account invulnerable. b is not right: passkeys work on phones and computers. c is not right: the NCSC says passkeys are at least as secure as, and generally more secure than, a password with two-step verification.
- What Would You Do? Treat it as a red flag. Your passkey is not offered because the page is not your provider's genuine address. Do not type your password. Close the page, go to your email provider yourself, and check your mailbox there. If you did type anything, change that password straight away.
Key Takeaways
- A passkey replaces a password with a key pair: the private key stays with you and is never sent to the website, and you unlock it with your face, fingerprint or PIN.
- Passkeys provide phishing-resistant authentication because the credential is cryptographically bound to the legitimate service/domain.
- Phishing resistance is not invulnerability: account recovery and compromised devices or accounts remain risks.
- Synced passkeys are restored from your credential manager if you lose a device; keep a backup method on every important account.
- The NCSC (April 2026) says passkeys should be your first choice wherever they are offered.
Sources
- FIDO Alliance — Passkeys
- NCSC — Leave passwords in the past: passkeys are the future (April 2026)
- NCSC — Passkeys: what you need to know
- NCSC — Trusting the tech: using password managers and passkeys to help you stay secure online (June 2025)
- Google — Passwordless by default: Make the switch to passkeys (October 2023)
- Microsoft — Pushing passkeys forward: Microsoft's latest updates for simpler, safer sign-ins (May 2025)