The Worst Authentication System, Except for All the Others
Passwords are terrible. Users reuse them across services. They’re stolen in data breaches (HaveIBeenPwned tracks over 13 billion compromised accounts). They’re phished with convincing fake login pages. They’re guessed with credential-stuffing attacks. And yet, for decades, they were all we had. That’s finally changing in 2025, not because passwords got better, but because they’re being replaced entirely.
Passkeys: The FIDO2 Standard Goes Mainstream
Passkeys are the consumer-friendly implementation of the FIDO2/WebAuthn standard developed by the FIDO Alliance (whose members include Apple, Google, Microsoft, Amazon, Meta, and every major bank). The technology uses public-key cryptography: when you create a passkey, your device generates a cryptographic key pair. The private key stays on your device (secured by the device’s biometrics or PIN). The public key is sent to the website. When you log in, the website sends a challenge that your device signs with the private key. The website verifies the signature with the public key. No shared secret is transmitted; no password is stored on the server.
The phishing resistance is the killer feature. A phishing site that looks exactly like your bank’s login page can’t intercept a passkey authentication because the cryptographic challenge is domain-bound — a passkey created for bank.com won’t work on bank.scam.com. This fundamentally breaks the phishing model that has driven the vast majority of account compromises for two decades.
Adoption numbers in 2025 are encouraging:
- Google: Passkeys have been used for authentication over 1 billion times across Google services. Over 400 million Google accounts have passkeys enabled. Google is moving toward making passkeys the default sign-in method.
- Apple: Passkeys are integrated into iCloud Keychain, synchronizing across all Apple devices signed into the same iCloud account. Apple calls them “the next generation of account security.”
- Microsoft: Passkeys are integrated into Windows Hello and Microsoft accounts. Microsoft Entra ID (formerly Azure AD) supports passkeys for enterprise authentication.
- Consumer services: PayPal, eBay, Best Buy, Kayak, Docusign, TikTok, WhatsApp, and hundreds of other services have implemented passkey support. The number of sites supporting WebAuthn has grown roughly 5x since 2022.
How Passkeys Work in Practice
The user experience is the selling point. To create a passkey: click “Create Passkey,” authenticate with your face/fingerprint/PIN, done. To login: click “Sign in with Passkey,” authenticate with your face/fingerprint/PIN, done. No typing, no password manager, no SMS code. It’s faster than passwords and — crucially for adoption — easier.
The synchronization question is where platforms differ. Apple syncs passkeys through iCloud Keychain (end-to-end encrypted). Google syncs through Google Password Manager. Third-party password managers (1Password, Dashlane, Bitwarden) support passkeys with cross-platform sync. This creates some lock-in — moving passkeys between ecosystems isn’t seamless — but the FIDO Alliance is working on a credential exchange protocol.
For enterprise environments, passkeys solve several problems simultaneously: no more password reset tickets (password resets cost organizations an estimated $70 per reset according to Forrester, or more according to Gartner — either way, it’s a lot), no more shared credentials, phishing resistance by default, and compliance with cyber insurance requirements that increasingly mandate MFA.
Biometrics: The Privacy-Comfort Tradeoff
Passkeys typically rely on device biometrics (fingerprint, face, iris) for user verification — but critically, the biometric data never leaves your device. The biometric is used to unlock the private key locally; it’s not transmitted to the website. This is a fundamentally different model from centralized biometric databases (like India’s Aadhaar or China’s facial recognition systems) that create permanent privacy risks.
The distinction matters: device-bound biometrics (Apple Face ID, Windows Hello, Android Biometric) are privacy-preserving because the biometric template stays on-device in a secure enclave. Centralized biometrics (government ID systems, corporate biometric databases) create permanent, irrevocable identity tokens that, if breached, can’t be reset. You can change your password; you can’t change your face.
What Still Needs to Work
Passkeys aren’t a panacea yet. Recovery when you lose all your devices is an unsolved problem — most services offer recovery codes or fallback to email/SMS, which reintroduces phishing vectors. Cross-platform passkey sharing remains awkward (FIDO’s Credential Exchange Protocol is still being finalized). And not all services support passkeys — financial institutions, healthcare providers, and government services (exactly the places that need phishing resistance most) are lagging.
Legacy enterprise applications that use LDAP, RADIUS, or Kerberos — none of which support FIDO2 natively — require middleware or replacement to integrate passkeys. This is expensive and slow. The reality is that passwords will coexist with passkeys for at least another decade, and hybrid authentication environments create their own security challenges.
Where We’re Headed
Passwordless authentication is the most important security improvement since multi-factor authentication went mainstream, and unlike MFA (which adds friction), it actually improves the user experience. The technical foundation (FIDO2/WebAuthn) is solid. Adoption is growing rapidly. The remaining barriers are mostly deployment inertia, not technology limitations.
The password era isn’t over, but its end is in sight. In 10 years, typing a password to log into anything important will feel as archaic as dial-up internet. The combination of passkeys, device biometrics, and continuous authentication will replace the “username + password + SMS code” model that has dominated digital identity for 30 years. And cybersecurity will be measurably better for it.