What is a passkey?

Passwords are a big problem. Everyone keeps using the same weak passwords over and over again, and even then, we can't remember them. Worst of all, long, unique, strong passwords with lots of special characters and random capital letters aren't all that secure: they're vulnerable to phishing and other scams, and they're especially easy to forget.

A great password manager can fix some of these problems, but they're really just papering over the cracks in an outdated, insecure system. And if your password manager messes up, all your passwords could be compromised.

Fortunately, there are better ways of securing accounts and information. We at Odyssey are committed to continuously improving our security and technology to keep your accounts and information safe. We keep adding new features for this, and after almost a decade in development, passkeys are now here. Here's what you need to know.

What is a passkey?#

A passkey is a new way of logging in to online accounts, services, and apps that's designed to be faster, easier to use, and more secure than passwords.

Passkeys rely on public-key cryptography to verify your identity rather than a username and password. This means there is nothing to remember, so you can't forget it like a password, and your devices get a single-use login credential each time you sign in to an account, so your account details can't easily be stolen by a hacker or a phishing attack. If all this sounds complicated, don't worry: it all happens in the background. Logging in is actually really simple.

Passkeys were created by an industry group called the FIDO Alliance that includes companies like Apple, Google, Microsoft, Amazon, 1Password, Dashlane, American Express, Intel, Mastercard, Meta, PayPal, Samsung, Visa, and many more. Passwords are widely considered to be a huge global problem, so there are a lot of companies interested in a better, more secure solution.

How do passkeys work?#

Now that you've got some idea of what passkeys are, let's dive into how they work—and why they offer better security than passwords.

Passkeys are part of a new web standard called Web Authentication or WebAuthn. Instead of a username and password, WebAuthn uses a principle called public-key cryptography to verify your identity. It's the same solution that secure messaging apps use to encrypt your conversations and online payment processors use to make sure your credit card details don't get stolen, so it is well understood and widely used.

When you go to create an account for a service that uses WebAuthn, instead of you (or your password manager) creating a password that matches some complex arbitrary criteria, your device will create a unique pair of mathematically related keys. One is called the public key, and the other is called the private key.

• The public key isn't a secret. It gets stored on the service's servers, but it really doesn't matter if hackers steal it or it otherwise gets leaked. It can genuinely be public knowledge without it affecting your security.
• The private key, on the other hand, gets stored securely on your device, and it has to remain a secret.

The next time you go to log in to that service, it will use the public key tied to your account to create a challenge for your device. Because the public key and private key are mathematically related, your device will be able to solve that challenge using its stored private key without revealing it to the server. That way, your device can verify your identity without any sensitive information changing hands—and so there's nothing for phishers or hackers to steal.

From a user perspective, things are even simpler. When you log in to an account that uses WebAuthn, your device or web browser prompts you to unlock your account using your PIN or a biometric option like Face ID or Touch ID. And that's it. All the public and private key work happens automatically in the background.

Of course, this is a slightly idealised workflow: it's how things will work once passkey support is widespread. For now, there are a few caveats.

What devices support passkeys?#

Passkey support keeps growing: most common devices and browsers support the technology, more and more online services are adopting it, and now Odyssey does too.

Are passkeys the future?#

Passkeys are a significantly more secure alternative to passwords, and under ideal circumstances they offer a much better user experience. In the coming years, as passkey support spreads, they are likely to be the best option for important accounts. But passkey support isn't quite there yet, and there are still a few edge cases where things are awkward.

• While passkeys make signing up for an account and logging in from known devices easier, they make moving to a different operating system or a new device more awkward. They aren't yet widespread enough for this to be a real problem, but expect setting up existing accounts on new devices (especially if you no longer have your old device) or recovering an account to be more awkward than resetting a password.
• Devices are getting passkey support, but passkeys also have to be enabled by websites, apps and other services. They are likely to become the standard for important accounts, but it will be a long time before they are anything close to universal.

So, although we've finally got something that looks like a possible solution to the password problem, it isn't a perfect fix—and we're going to be dealing with the transition for a while.

We at Odyssey continuously follow the online security community for new technologies that can improve security and ease of use for our users.