The password is dying the way old technologies do: not in a single announcement but in a million small defaults. Create an account with a major platform today and the first credential you are offered is a passkey — a cryptographic key stored on your phone or computer, unlocked with your face or fingerprint. Security agencies that spent decades pleading with the public to choose stronger passwords have changed their advice entirely: the safest password, they now say, is the one that does not exist.
The technology, standardised by the FIDO Alliance, replaces the shared secret with a key pair. The private key never leaves your device; the website holds only the public half, useless to thieves who breach its database. Crucially, a passkey is bound to the real website’s address, so the fake login pages that harvest passwords by the million simply do not work — there is nothing to type and nothing to phish. Guidance from agencies such as CISA, the US cybersecurity authority, now lists phishing-resistant authentication of this kind as the gold standard for account security.
The Questions Everyone Asks
Two worries dominate. First, the lost phone: passkeys sync through your platform account — Apple, Google or Microsoft — so a new device restores them after you prove your identity to the platform, usually with recovery steps that deserve setting up before you need them. Second, the shared computer: passkeys can also live on a small hardware key or be used from your phone to authorise a sign-in elsewhere by scanning a code. What genuinely changes is the burden of memory: nothing to invent, forget, reuse or type. The elderly relative whose password is the dog’s name becomes, almost accidentally, well defended. More security explainers live in our technology section.
What to Do This Week
The Shared-Device Problem
The passkey transition has an awkward edge the keynote demos skip: the world’s devices are often shared. Families share tablets, workers share terminals, and in much of the world a phone moves between hands across a day. Platform passkeys, bound to one person’s account and biometrics, fit the affluent single-owner model better than the shared reality — which is why passwords, for all their sins, are lingering longest exactly where devices are fewest per person. The industry’s answers are partial: guest profiles, hardware keys for shared stations, and risk-based step-up checks for sensitive actions. The honest forecast is a long hybrid era in which the passkey protects the banking app while the family tablet keeps its PIN. Security transitions are never only about cryptography; they are about whose life the design imagines, and the password’s stubborn afterlife marks the lives it had not imagined yet.
The accessibility ledger deserves a line in passkeys’ favour. Passwords punish exactly the users least able to manage them — the elderly, the cognitively impaired, anyone whose memory or dexterity is taxed by a string of symbols invented to defeat machines. A fingerprint or a face is not a memory test. Care settings and family tech-support veterans report the same relief: the relative who wrote passwords on paper by the phone now unlocks accounts with a thumb. Security design spent decades optimising against the user’s weaknesses. The passkey is the first mainstream credential that treats the user’s body, rather than the user’s memory, as the strong point — and for millions of people that is not a convenience. It is the difference between independence and dependence.
The practical advice is unglamorous and effective. Turn on passkeys where offered for your most important accounts — email first, since email resets everything else, then banking and social media. Keep your existing strong passwords and two-factor settings as backup rather than deleting them in a burst of enthusiasm, and set up account recovery while you are calm. The password era will not end with a ceremony; it will end the way it has been ending, one default setting at a time, until typing a secret from memory feels as dated as it deserves to.
