# Do you know what a passkey is and how one works? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [October 14, 2026, 9:19pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842 "2026-10-14T21:19:12Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [October 15, 2026, 3:56am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/21 "2026-10-15T03:56:09Z")
> [@Kent\_Clark](#): > > Having read through the thread this far, I’ve concluded that I want nothing to do with passkeys. I think that’s the wrong message to take. Passwords and MFA have a lot of issues too, and a good passkey implementation is generally more secure. L I don’t share passkeys between devices, so I don’t run into the challenges @Reply describes. I have one set of passkeys on my laptop and one on my phone. I’ve never had a conflicts with multiple providers trying to store or serve passkeys. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [October 15, 2026, 4:42am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/22 "2026-10-15T04:42:54Z")
> [@bump](#): > > Basically when you create a passkey, you are creating a key pair for that account. The public key goes to the site, the private key is kept locally. A Yubikey or similar dongle should be able to do that. ---
**Author:** ![Lare](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@Lare](https://boards.straightdope.com/u/Lare)\ **Post date:** [October 15, 2026, 5:17am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/23 "2026-10-15T05:17:49Z")
> [@Heracles](#): > > I believe the idea is that your trusted device, typically your phone, is supposed to certify to the website that you are you. So it may ask for a fingerprint or a face print, It seems that not that long ago we were hearing warnings about _not_ using biometrics because (to site a semi-paranoid example) someone could, under certain circumstances, compell you to provide your fingerprint, or forcefully “use” your face. I am not enamoured of biometrics yet. I prefer not to trust them on my device. My phone could be stolen while unlocked. My PC has no camera or fingerprint reader. I don’t have, or particularly want, to carry a Yubi key that could also be lost. I’m pretty sure I have a basic understanding of their benefits, but until they can make it as convenient as my password manager I’m not ready to get on board. ---
**Author:** ![Broomstick](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/broomstick/32/246_2.png) [@Broomstick](https://boards.straightdope.com/u/Broomstick)\ **Post date:** [October 15, 2026, 11:18am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/24 "2026-10-15T11:18:56Z")
> [@Dewey\_Finn](#): > > When I’m trying to connect to a website is _not_ the time to introduce me to a new idea like a passkey; at that point I just want to get to the website and make a transaction or whatever. ^ This. My place of work wants us to clock in and out using our personal phone and their software (which I’m already VERY unhappy about - they would _never_ let me load software of my choosing on _their_ machines but they demand I load _their_ software on my personal phone). So, I go to clock in from lunch one day and all of a sudden it’s demanding a passkey! It didn’t need one that morning when I arrived at work. WTF? What is this? And it wants biometrics? My phone is not currently set up for biometrics. No, I _don’t_ use my face or fingerprint to sign into my phone. Standing in a busy store getting jostled by passing customers already past the time I’m supposed to clock back in is NOT when I’m going to set up that sort of thing. _Fortunately_ there is an alternate means for us to clock in and out, intended for if the wifi is down and pretty much everyone was using it for the rest of the day. Talk about a bad implementation! Turned out it had been released _three days early_, the day _before_ everyone was supposed to be notified of the change so they could set up a passkey. Instead, _no one_ had one set up and _everyone_ was unable to access the timeclock. As a result, very, very, very few people are setting up passkeys for this. Bad taste all around. Also, why the F am I having to set up a whole new thing on MY PHONE because THEY are too f’ing cheap to provide hardware they own? Again, I am not allowed to load software on THEIR equipment, but they are demanding that I load their software on mine! So… yes, I do know what a passkey is and how one is supposed to work. Yes, I know my phone _could_ use biometrics but I don’t. Why? Because in the event of my incapacitation I want my designated representative to be able to use my phone, computer, and access my accounts in order to act on my behalf and since they don’t have my face or fingerprint attached to their body that means passwords. At this point, my “introduction” to the passkey thing has been largely what I went through at work - sudden, unexpected, unannounced in advance and demanding I change the way I do things without regard to my concerns or needs or preferences. I don’t see where I get additional benefit. I am capable of memorizing a 12 or 15 digit complex password, or using a long pass phrase. I am cautious about what I do on line. I even do a certain amount of things in “meatspace” rather than the so-called convenience of on-line. And, regardless of what I, personally, do companies and corporations and banks will continue to be hacked. With AI I fully expect at some point biometrics will be hacked - it will be able to imitate your face or finger sufficiently to fool the average biometric scanner on a phone. In which case anyone using biometrics is F’d because you can change a password. You can’t change your face or fingerprint or iris scan or whatever it’s using. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [October 15, 2026, 11:22am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/25 "2026-10-15T11:22:43Z")
> [@TroutMan](#): > > I’ve never had a conflicts with multiple providers trying to store or serve passkeys. May I ask what variety of devices, browsers, and PW/PK storage apps you use? Not doubting your experience. I may want to emulate it if my situation is already close enough to yours. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [October 15, 2026, 11:26am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/26 "2026-10-15T11:26:19Z")
> [@Broomstick](#): > > With AI I fully expect at some point biometrics will be hacked - it will be able to imitate your face or finger sufficiently to fool the average biometric scanner on a phone. In which case anyone using biometrics is F’d because you can change a password. You can’t change your face or fingerprint or iris scan or whatever it’s using. Interesting concern. And not one I’d put much thought into. As to the incapacitation thing, typically you’ll have authentication set up as one or more of face, fingerprint, _and_ old fashioned password. Not face or fingerprint _instead if_ password. So you can use the face or fingerprint for day to day convenience, but retain the PW for backup use. If you’re incapacitated and your rep already has the password, they can login that way and proceed normally. Whether they choose to then disable face and/or fingerprint or leave them live but unused is up to them. ---
**Author:** ![Broomstick](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/broomstick/32/246_2.png) [@Broomstick](https://boards.straightdope.com/u/Broomstick)\ **Post date:** [October 15, 2026, 11:37am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/27 "2026-10-15T11:37:58Z")
The password backup only works if you set it up that way. My information (which may not be accurate or complete) is that you can set up access with _just_ a passkey for some programs and sites, with no password backup. Admittedly, some of this is my old fart stubbornness kicking in, but I’ve been working with computers since the mid-1970’s and I’m tired of change for the sake of change. If passkeys are still around in 5 years and functioning as advertised maybe I’ll bother with them. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [October 15, 2026, 11:50am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/28 "2026-10-15T11:50:04Z")
I share your attitude. I’m getting a bit tired of tech churn for what seems like just churn’s sake. ---
**Author:** ![FlikTheBlue](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fliktheblue/32/10972_2.png) [@FlikTheBlue](https://boards.straightdope.com/u/FlikTheBlue)\ **Post date:** [October 15, 2026, 11:54am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/29 "2026-10-15T11:54:07Z")
AFAICT a passkey is basically just a second password. I work with one system that requires a passkey, the system that I use to prescribe controlled substances. It’s supposedly part of a “two factor authentication”, which I put in quotes because in reality it’s a six factor authentication. There’s my username to log into the electronic health record, the password for the electronic health record, then a 6 digit code that gets texted to me which I have to enter within 30 seconds. Then to prescribe a controlled substance, I need another password, then a passkey along with another 6 digit code from a code generating app. ---
**Author:** ![Cardigan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cardigan/32/187_2.png) [@Cardigan](https://boards.straightdope.com/u/Cardigan)\ **Post date:** [October 15, 2026, 12:23pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/30 "2026-10-15T12:23:19Z")
I’m joining the ‘don’t know what a passkey is’ chorus. ---
**Author:** ![Thumper668](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thumper668/32/20803_2.png) [@Thumper668](https://boards.straightdope.com/u/Thumper668)\ **Post date:** [October 15, 2026, 12:49pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/31 "2026-10-15T12:49:59Z")
I do know what they are and how they work and I use them whenever possible. They are much more secure than passwords, even with 2FA in some cases. They use public key cryptography in both directions so the private key is never sent and can’t be intercepted. In layman’s terms - as long as your means of authentication with your device (phone or computer) is secure, the passkey is secure. ---
**Author:** ![Thumper668](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thumper668/32/20803_2.png) [@Thumper668](https://boards.straightdope.com/u/Thumper668)\ **Post date:** [October 15, 2026, 12:53pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/32 "2026-10-15T12:53:15Z")
> [@TroutMan](#): > > I don’t share passkeys between devices If it’s a properly implemented passkey, you _can’t_ share them between devices. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 15, 2026, 1:14pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/33 "2026-10-15T13:14:33Z")
> [@Thumper668](#): > > They use public key cryptography in both directions so the private key is never sent and can’t be intercepted. So do all competent password systems. They use them a little bit differently, but the effect is the same: The secret key itself is never actually transmitted in a way that can be intercepted. And if the system you’re accessing wasn’t competent enough to implement passwords correctly, what makes you think they’ll be competent enough to implement passkeys correctly? ---
**Author:** ![Thumper668](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thumper668/32/20803_2.png) [@Thumper668](https://boards.straightdope.com/u/Thumper668)\ **Post date:** [October 15, 2026, 1:24pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/34 "2026-10-15T13:24:31Z")
Far too many systems (including banks) use SMS for 2FA. I have more faith in passkeys simply because there are fewer points of failure, irrespective of the competence of the implementer. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 15, 2026, 1:27pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/35 "2026-10-15T13:27:42Z")
There are exactly as many points of failure for passkeys as for any other security system: Some incompetent developer completely misunderstands how it’s supposed to work, implements something horribly insecure, and calls it a passkey. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [October 15, 2026, 1:46pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/36 "2026-10-15T13:46:15Z")
If passkeys eliminate websites’ desires for 2FA via SMS I’m now all for them. Not because I’m worried about the insecurity of SMS. But becase I’m tired of the irritation of the extra authentication step. ---
**Author:** ![Thumper668](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thumper668/32/20803_2.png) [@Thumper668](https://boards.straightdope.com/u/Thumper668)\ **Post date:** [October 15, 2026, 1:52pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/37 "2026-10-15T13:52:37Z")
> [@LSLGuy](#): > > If passkeys eliminate websites’ desires for 2FA via SMS That is unlikely to happen, largely because of user confusion and their general unpopularity. Authenticator apps are a more likely possibility, but the challenge there is universality. I have 3 of them on my phone because I can’t use a single app for everything that supports it. It would please me if it happened, but I’m not holding my breath. ---
**Author:** ![robby](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/robby/32/11048_2.png) [@robby](https://boards.straightdope.com/u/robby)\ **Post date:** [October 15, 2026, 1:57pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/38 "2026-10-15T13:57:27Z")
> [@Broomstick](#): > > Because in the event of my incapacitation I want my designated representative to be able to use my phone, computer, and access my accounts in order to act on my behalf and since they don’t have my face or fingerprint attached to their body that means passwords. For what it’s worth, on an Apple iPhone or iPad, the backup for biometrics is the passcode by default. It’s also possible to enter a second biometric (Face ID or fingerprint) so that two people can open a device. I maintain my mom’s devices, so I’ve set up a second biometric on all her devices so I can easily open them. ---
**Author:** ![robby](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/robby/32/11048_2.png) [@robby](https://boards.straightdope.com/u/robby)\ **Post date:** [October 15, 2026, 2:05pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/39 "2026-10-15T14:05:58Z")
> [@Thumper668](#): > > > [@TroutMan](#): > > > > I don’t share passkeys between devices > > If it’s a properly implemented passkey, you _can’t_ share them between devices. Now I’m confused. If passkeys aren’t shared between devices, then how is it that a password manager like Apple Passwords is supposedly sharing them? (I have a section in that app labeled “Passkeys”, and they show up on all of my devices: iPhone, iPad, and MacBook.) ---
**Author:** ![Thumper668](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thumper668/32/20803_2.png) [@Thumper668](https://boards.straightdope.com/u/Thumper668)\ **Post date:** [October 15, 2026, 2:13pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/40 "2026-10-15T14:13:26Z")
I’m not sure. I’m relatively unfamiliar with the Apple ecosystem and I only have one Apple device. Perhaps Apple implements them differently. I’ll have to do some reading. [Previous page](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842.md?page=1) [Next page](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842.md?page=3)