How I Replaced Passwords with a Safer and Simpler Alternative

For some time now, I haven’t used my passwords to log into my Google and Microsoft accounts. Instead, I simply enter my email address, followed by the PIN I use on my Windows PC. Once I input the correct PIN, I effortlessly gain access without having to remember or type out a long, complex password.

This is the kind of seamless experience that passkeys provide, enhancing security compared to conventional passwords that can be compromised through phishing attacks or simply forgotten. Transitioning from passwords to passkeys has proven to be a beneficial shift for me, and I now appreciate the heightened security they offer.

Defining Passkeys: A Superior Alternative to Passwords

The Mechanics Behind the Cryptographic Handshake

Google sign in screen asking for the passkey — Image credit – self captured (Tashreef Shareef) – No Attribution Required

A passkey functions as a digital substitute for traditional passwords, leveraging public key cryptography instead of relying on a memorized sequence of characters. Upon creating a passkey for a specific website, your device generates two interrelated keys. The public key is sent to the service, while the private key remains secured on your device—utilizing the trusted platform module (TPM) chip found in Windows Hello or the secure enclave on smartphones.

The unique advantage of passkeys lies in their inability to be fooled; they only operate on designated sites. Even if you inadvertently visit a phishing site that mimics Gmail, your device will refuse to disclose the private key, successfully recognizing it as a fraudulent domain. Consequently, no password or credential exposure occurs, resulting in a failed login attempt without the risk of a phishing attack.

Passkeys address two critical challenges associated with traditional login methods. First, they authenticate that you are accessing the legitimate site by verifying the domain before utilizing the key, thereby thwarting phishing attempts. Second, they generate a one-time cryptographic signature rather than revealing a reusable password, confirming your identity securely.

Passkeys Maintain Security Even When Devices Are Lost

Utilizing Multiple Keys for the Same Account

Ultrasonic fingerprint sensor icon on the OnePlus 13 — Photo by Justin Duino / MakeUseOf

A frequent source of confusion regarding passkeys is their functionality upon losing a device. The significant takeaway is that losing your smartphone or laptop does not mean being locked out of your accounts since each device retains its unique passkey. In the event of losing your phone, you can still log in from another device using its specific passkey or revert to your account password if necessary.

If your device is stolen, passkeys cannot be accessed without the requisite biometric authentication or PIN. Additionally, you can manage all your registered passkeys through your account settings, allowing you to revoke access from any lost or compromised devices.

Once you acquire a new device, you simply create a new passkey for your accounts after authenticating through another trusted device or utilizing a backup method like your password.

Creating and Safely Storing Passkeys

Getting Started on Various Platforms

For your Windows computer to utilize passkeys, enable Windows Hello. If you currently use a PIN or fingerprint scanner, it’s likely already activated. Otherwise, navigate to Settings > Accounts > Sign-in options to set up a biometric sign-in method. When websites allow passkey creation, Windows Hello will manage the secure storage automatically.

On Android devices running version 9 or later, passkeys are automatically saved to Google Password Manager, synchronizing across all devices linked to the same Google account. Android 14 now supports integration with third-party password managers for those preferring specialized security tools.

Apple simplifies the process further by storing passkeys in iCloud Keychain on both iOS and macOS devices, ensuring synchronization across all Apple devices. Ensure that two-factor authentication is enabled for your Apple ID to facilitate this seamless functionality.

A password input prompt in the Passwords bar under iCloud Keychain — Screenshot by Adaeze Uche

For cross-platform compatibility, consider using password managers such as 1Password, Bitwarden, or Dashlane, which now support passkeys. This provides a unified method to manage your passkeys regardless of the device used.

Personally, I lean towards native platform solutions as I primarily operate within Windows and Android. However, utilizing a password manager is practical for those frequently switching among various ecosystems like Windows, Mac, iPhone, and Android.

Steps to Create Passkeys

Many websites supporting passkeys will automatically offer you the option to create one after you log in with your password.

If you do not encounter a prompt, you can manually create a passkey by heading to the account settings on the respective website and locating the security section. For instance, to establish a passkey for your Google account, navigate to g.co/passkeys, click on Create a passkey, and follow the outlined steps.

Current Support for Passkeys

Widespread Adoption Among Major Platforms

Google passkey sign showing Windows hello dialog — Photo by Tashreef Shareef / MakeUseOf

Numerous major websites, including Google, Microsoft, Apple, Amazon, Adobe, and Meta (encompassing Facebook and Instagram), have embraced passkeys. I’ve personally implemented them across my Google Workspace, Microsoft account, and even PayPal. Each time I log in, I opt to use a passkey and authenticate via my PIN.

The experience can differ slightly from service to service. For example, Google allows users to switch to using passkeys for daily logins, with the option to remove their password if desired. However, some services still necessitate retaining a password as an alternative. Currently, all primary platforms permit the creation of a password for new accounts, but once passkeys are in place, passwords become less essential.

The Enduring Future of Passkeys

Embracing Passwordless Sign-Ins

While the adoption of passkeys is gradually gaining traction, many sites are still in the early stages of this transition. However, when available, the sign-in experience becomes significantly more convenient. It is important to note that passwords are still required to create new accounts and serve as backup options for logging in from unsupported devices or in case any issues arise with your passkeys.

This indicates that while passwords have not yet vanished, they will continue to exist for compatibility, recovery, and for those services that haven’t yet modernized. Nevertheless, for everyday access, the ease of avoiding password entry and the enhanced protection against phishing threats underscores why embracing passkeys is a wise choice.

Source & Images