# Do you know what a passkey is and how one works? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [October 14, 2026, 9:19pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842 "2026-10-14T21:19:12Z")\ **Posts on this page:** 15\ **Page:** 4
**Author:** ![crazyjoe](https://avatars.discourse-cdn.com/v4/letter/c/f14d63/32.png) [@crazyjoe](https://boards.straightdope.com/u/crazyjoe)\ **Post date:** [October 15, 2026, 9:18pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/61 "2026-10-15T21:18:10Z")
My opinion about passkeys is they can fuck off already. I spent a good bit of time setting up a password manager to auto-fill my passwords and thanks to passkeys a shit-ton of sites and apps don’t work smoothly with it anymore. The only app I trust to store passkeys on both my Windows and Android devices is 1Password. Not fucking microsoft, not fucking samsung (is there a three fuck limit in IMHO? oops.) But 1Password doesn’t reliably detect and store passkeys from different websites, so all it does is create extra steps for me when I want to log in. Don’t even get me started on all the motherfuckers now who don’t even let you opt for a password but instead either send you an e-mail or demand your mobile number so they can text you a code. I have FIVE damned MFA tools on my phone because interoperability is just not a thing with certain companies. Using my cell phone number should not be a stinking option, nor do I want you to call my phone to read out a number to me. In conclusion: fuck ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [October 15, 2026, 9:39pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/62 "2026-10-15T21:39:31Z")
> [@crazyjoe](#): > > I have FIVE damned MFA tools on my phone because interoperability is just not a thing with certain companies. Why is this? I have a single authenticator app that I use for any site that needs it. Just because Google suggests you use their app, doesn’t mean you have to. It’s an open spec that most sites follow. I’ve heard some gaming sites use their own proprietary app. Are there others you use that force you to use something? ---
**Author:** ![billy-jack](https://avatars.discourse-cdn.com/v4/letter/b/ac91a4/32.png) [@billy-jack](https://boards.straightdope.com/u/billy-jack)\ **Post date:** [October 15, 2026, 9:47pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/63 "2026-10-15T21:47:29Z")
There is something about passkeys that concerns me greatly. If someone can get access to your account, they may be set up their own passkey. If they do, then they have full access to that account even if you change passwords. And the only way to know that they are there is to check to see what passkeys are enabled. Even if you have never set up a passkey, the attackers could have one or more set up for themselves to access your account. And if you have never set one up, why would you think about checking to see if someone else set one up on your account? ---
**Author:** ![billy-jack](https://avatars.discourse-cdn.com/v4/letter/b/ac91a4/32.png) [@billy-jack](https://boards.straightdope.com/u/billy-jack)\ **Post date:** [October 15, 2026, 9:52pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/64 "2026-10-15T21:52:50Z")
> [@crazyjoe](#): > > I have FIVE damned MFA tools on my phone because interoperability is just not a thing with certain companies. I use the ProtonAuthenticator for MFA. The nice thing about it is that it is synced between various accounts. Once I set it up using the cell phone to capture the QR code, I can use it from my desktops as well as from my virtual machines. ---
**Author:** ![billy-jack](https://avatars.discourse-cdn.com/v4/letter/b/ac91a4/32.png) [@billy-jack](https://boards.straightdope.com/u/billy-jack)\ **Post date:** [October 15, 2026, 9:55pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/65 "2026-10-15T21:55:45Z")
On my servers, secure shell is set up to require three separate ssh keys. In some cases using a jump account, it can take six separate ssh keys if the jump account itself is set up to use a separate set of three ssh keys then the other accounts. I have been tempted to get a hardware key and use them whenever practical. I haven’t checked to see if I can use them for secure shell (ssh) connections. ---
**Author:** ![Procrustus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/procrustus/32/2994_2.png) [@Procrustus](https://boards.straightdope.com/u/Procrustus)\ **Post date:** [October 15, 2026, 10:01pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/66 "2026-10-15T22:01:52Z")
Regardless of what happens below the surface, for the user, is using a passkey the same or different than using a password? ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [October 15, 2026, 10:52pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/67 "2026-10-15T22:52:01Z")
The thing is that in a passkey system, only your side ever has the private password/key. All the other side has is the public key. Password systems by definition have to have the password on both sides, even if only a hash is stored. > [@Procrustus](#): > > Regardless of what happens below the surface, for the user, is using a passkey the same or different than using a password? Fundamentally different. Password systems have the password (or a hash of the password) on both sides. Passkey systems are based on public key encryption, which means that the private key (the verification method) is only kept on your computer and isn’t sent anywhere. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [October 15, 2026, 11:30pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/68 "2026-10-15T23:30:10Z")
It’s Russian. They passkey down the streetsky. ---
**Author:** ![Procrustus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/procrustus/32/2994_2.png) [@Procrustus](https://boards.straightdope.com/u/Procrustus)\ **Post date:** [October 15, 2026, 11:49pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/69 "2026-10-15T23:49:51Z")
> [@bump](#): > > Fundamentally different. Password systems have the password (or a hash of the password) on both sides. Passkey systems are based on public key encryption, which means that the private key (the verification method) is only kept on your computer and isn’t sent anywhere. But what do I do as a user? Do I just type in a passkey like I would type in a password? Or is it a whole different procedure? ---
**Author:** ![robby](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/robby/32/11048_2.png) [@robby](https://boards.straightdope.com/u/robby)\ **Post date:** [October 15, 2026, 11:58pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/70 "2026-10-15T23:58:54Z")
> [@Procrustus](#): > > But what do I do as a user? Do I just type in a passkey like I would type in a password? Or is it a whole different procedure? It’s all handled automatically by your device (i.e. phone, tablet, or computer). You basically give your device permission to send the passkey to the website. This is typically a biometric (like Face ID or fingerprint), but could also be a _device_ password or passcode. Essentially you have to identify yourself to your device by some method in order to give your device permission to send the passkey. ---
**Author:** ![Broomstick](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/broomstick/32/246_2.png) [@Broomstick](https://boards.straightdope.com/u/Broomstick)\ **Post date:** [October 16, 2026, 1:34am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/71 "2026-10-16T01:34:02Z")
> [@robby](#): > > For what it’s worth, on an Apple iPhone or iPad, the backup for biometrics is the passcode by default. It’s also possible to enter a second biometric (Face ID or fingerprint) so that two people can open a device. I maintain my mom’s devices, so I’ve set up a second biometric on all her devices so I can easily open them. Thank you, that’s good to know. As it happens I’m an Android user so I’m not sure that’s an option for us, but I have several close people who are in the iPhone world and might want to know that. I’ll pass it on. ---
**Author:** ![crazyjoe](https://avatars.discourse-cdn.com/v4/letter/c/f14d63/32.png) [@crazyjoe](https://boards.straightdope.com/u/crazyjoe)\ **Post date:** [October 16, 2026, 3:25am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/72 "2026-10-16T03:25:16Z")
I’m a consultant. Some client VPNs require their particular MFA software, like RSA or Microsoft Authenticator. If you don’t use it, at the very least it can’t do a “push” to your phone for easy authentication, and sometimes it flat out will not work unless you use it. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [October 16, 2026, 10:06am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/73 "2026-10-16T10:06:17Z")
> [@Broomstick](#): > > As it happens I’m an Android user Androids (at least Samsungs) can accept multiple fingerprints. I have 4 stored so whichever hand is free can open the phone no matter how I’m holding it. There’s nothing that says those prints all have to be attached to one person. In fact there’s no way the phone could know whether they are are aren’t the same person. I haven’t tried multiple faces so I can’t vouch for that. Easy experiment to make though. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [October 16, 2026, 10:08am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/74 "2026-10-16T10:08:21Z")
Yep. Another case where it’s to each vendor’s advantage to push proprietary non-interoperable solutions to common problems. ---
**Author:** ![Heracles](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/heracles/32/487_2.png) [@Heracles](https://boards.straightdope.com/u/Heracles)\ **Post date:** [October 17, 2026, 3:01am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/75 "2026-10-17T03:01:25Z")
Thank you, that was the most useful (well, the least useless) article I’ve ever read on the subject. Opinionated, yes, but very informative. [Previous page](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842.md?page=3)