GoKawiilA concerted effort to get rid of passwords began roughly two days after the password was invented. Passwords are a pain—you’ll get no argument here—but we don’t see them going away in the foreseeable future. The latest effort to eliminate the password comes from the FIDO Alliance, an industry group aimed at standardizing online authentication methods. Does this sound a little bit like the infamous xkcd 927? Yes, yes it does. But thanks to the monopolistic nature of devices, it might work this time.
Apple supports the FIDO specs and coined the term passkeys, which has caught on. Passkeys are generated cryptographic keys managed by your device (usually your phone). They’re easy to create—you don’t need to do anything, as your device handles the details. Your passkeys are stored on your device and protected by either biometrics or PINs. Since passkeys are generated key pairs instead of passwords, there’s nothing to remember. If you are familiar with GPG keys, they’re somewhat similar in that there’s a public and private key; the website you want to log in to has a public key and sends it to your device. Your device compares that to the private key it has, and you’re signed in (or not, if the keys don’t match).
While passkeys aren’t a radical departure, they’re still an improvement by virtue of being a preinstalled tool for people who aren’t going to read this article and immediately sign up to use one of the services below. If millions of people suddenly stop using 12345678 as a password, that’s a win for security.
Almost all of the apps we’ve suggested here can store passkeys, which means you can store your passkeys right alongside your passwords. Our two favorites, Bitwarden and 1Password, can generate, save, store, and sync passkeys. You can even log in to Bitwarden using a passkey, which pretty much eliminates the need for a password at all. Once you have a passkey stored, it will automatically sync to all your devices the same way Bitwarden and 1Password sync your passwords. When you return to that site, your password manager will log you in using the passkey you generated.
Think of passkeys as credit cards next to the cash (passwords) in your wallet. One day passkeys may work everywhere and there will be no passwords, no password managers. In the meantime we think it’s better to stick with a password manager, even if all you’re doing with that manager is storing passkeys.