If you've signed into Google, Amazon or WhatsApp recently, you may have been asked to create a passkey. It's one of the bigger changes to how logins work in decades, and clients have started asking whether their own websites should support it.
What a passkey is
A passkey replaces your password with a cryptographic key stored on your device. When you sign in, your phone or laptop asks you to confirm with your fingerprint, face, or screen lock PIN. Behind the scenes, the device proves it holds the key without ever sending a secret to the website.
For users, it feels like unlocking their phone. For the website, it means there's no password to steal.
Why it's more secure
Passwords fail in predictable ways. People reuse them across sites, so one breach leads to many. They get phished through fake login pages. They get guessed because "Company@123" is surprisingly common.
Passkeys solve all three:
- Each passkey is unique to one website, so there's nothing to reuse.
- A passkey only works on the real domain it was created for, which makes phishing pages useless.
- There's nothing to guess.
Even if your database leaked, attackers would only get public keys, which are useless on their own.
Is the support there?
Yes, for the most part. All major browsers and operating systems support passkeys now, and they sync across devices through Google Password Manager, iCloud Keychain and other password managers. Someone who creates a passkey on their Android phone can use it on their Chrome laptop.
Should your site use them?
For most small business websites, the answer is "not yet necessary", because most don't have customer logins at all. But if you run any of these, it's worth considering:
- A customer portal (orders, invoices, account details)
- A SaaS product
- An admin panel with sensitive data
- A membership or course platform
How we'd roll it out
We don't recommend removing passwords overnight. The approach that works:
- Offer passkeys as an option alongside the existing password login.
- Prompt users to add a passkey after they sign in successfully. "Sign in faster next time with your fingerprint."
- Keep a recovery path. Email-based recovery or backup codes for when someone loses their device.
- Watch adoption. Once most active users have a passkey, you can consider making passwords optional for new accounts.
From a development point of view, there are good open-source libraries for PHP and JavaScript that handle the WebAuthn standard behind passkeys. Adding passkey login to an existing app is typically a few days of work, not weeks.
The bottom line
Passkeys are one of those rare security improvements that also make things easier for users. If you have customer accounts, it's worth putting on the roadmap for this year. And at the very least, make sure your admin logins use two-factor authentication today.
