Passkeys explained: the beginning of the end for passwords

For decades, the password has been the front door to almost everything your business does online. It has also been the weakest lock on that door. Passkeys are the technology quietly replacing it, and for once the newer, safer option is also the easier one to use.

If you have signed into your bank or a shopping site lately and been asked to use your fingerprint or face instead of typing a password, you have probably already used a passkey without realising it. Here is what they are, why they matter for your business, and how to start using them without disrupting your team.

What a passkey actually is

A passkey is a way to sign in to a website or app without a password. Instead of a secret you type, your device holds a cryptographic key that proves who you are.

When you create a passkey for a service, two linked keys are generated. A private key stays locked on your device and never leaves it. A matching public key is stored by the service you are signing in to. When you log in, the service sends a challenge, your device answers it using the private key, and the maths lines up. You approve the whole thing with something you already use to unlock your phone or laptop: a fingerprint, a face scan, or a device PIN.

The important part is what does not happen. Your fingerprint or face never gets sent anywhere. It only unlocks the key on your own device. There is no shared secret sitting on a server for an attacker to steal, and nothing for you to remember, reuse, or accidentally type into a fake login page.

Passkeys are built on open standards from an industry group called the FIDO Alliance, and they are backed by Apple, Google and Microsoft. That shared backing is why passkeys now work across phones, tablets and computers rather than being locked to one brand.

Why passwords keep failing us

None of this would matter if passwords worked well. They do not, and the reasons are worth being honest about.

• People reuse them. Remembering dozens of strong, unique passwords is genuinely hard, so most people recycle a handful across many sites. One breach then unlocks several accounts.
• They can be phished. A convincing fake login page can capture a password the moment it is typed. Even careful staff get caught by a well-timed, well-designed email.
• They can be guessed or cracked. Short or common passwords fall quickly to automated tools.
• They leak in bulk. When a service you use is breached, its stored passwords can end up for sale, ready to be tried against every other account with the same details.

We have written before about what strong password security really looks like, and the honest conclusion is that even best practice has a ceiling. You can make passwords longer and add a second factor, but you are still defending a secret that can be stolen, tricked out of someone, or leaked. Passkeys remove the secret altogether.

The security case: phishing simply stops working

The single biggest advantage of a passkey is that it is tied to the exact website it was created for. Your device checks the real web address behind the scenes before it will respond.

That means if a staff member clicks a link in a scam email and lands on a near-perfect copy of your Microsoft 365 sign-in page, the passkey will not fire. There is no password to hand over, and the fake site is not the genuine one the passkey is bound to, so the login quietly fails. The attack that works against passwords, even passwords protected by a code from an app, falls flat against a passkey.

This matters enormously for Australian professional services firms. Accounting, legal and healthcare businesses are targeted precisely because their logins are the gateway to sensitive client data. Phishing is still the most common way attackers get in, and passkeys close that door in a way nothing else has.

Passkeys are also a natural fit if you are working towards recognised security standards. The Australian Signals Directorate’s Essential Eight lists multi-factor authentication as one of its eight core strategies, and passkeys are a strong, phishing-resistant form of it. If your business is pursuing SMB1001 certification or building out the Essential Eight, moving key accounts to passkeys is a tick in exactly the right column.

How passkeys work day to day

The experience for your team is deliberately simple, which is a large part of the appeal.

• Signing in means unlocking a key with your face, fingerprint or device PIN. No typing, no “forgot password” link, no code to copy from a text message.
• Across devices, passkeys can sync securely through your platform’s password manager, such as iCloud Keychain on Apple devices, Google Password Manager, or Microsoft’s equivalent. Create a passkey on your laptop and it can be there on your phone too.
• When you get a new device, you sign in to your account and your passkeys come with you, rather than resetting everything from scratch.
• For higher-security roles, passkeys can also live on a physical security key, a small device that plugs into a USB port or taps by contact, so the key is a physical object an attacker cannot reach remotely.

Microsoft 365 and Microsoft Entra already support passkeys, which is significant, because for most Australian small businesses Microsoft 365 is the account that matters most. Google Workspace, Apple accounts and a growing list of banks, government services and everyday apps support them too.

What to watch out for

Passkeys are a genuine step forward, but a sensible rollout plans for a few realities.

• Recovery needs thought. If someone loses every device that holds their passkeys, you need a safe way to get them back in. That usually means having more than one passkey per person and a clear, secure recovery process, rather than leaving it to chance.
• Coverage is not universal yet. Not every service your business uses will support passkeys, so passwords will not vanish overnight. Expect a transition period where both live side by side.
• Device management still matters. Because passkeys live on devices, keeping those devices updated, encrypted and controlled is part of the picture. This is ordinary good practice, and something we already handle as part of managed security.
• Shared logins are a problem, and always were. Passkeys work best with one identity per person. If your team currently shares a single login for a system, that is worth fixing regardless.

If you want the fuller background on the shift away from passwords, our earlier piece asking whether passwordless authentication is secure walks through the reasoning in plain terms.

Where to start

You do not need to change everything at once, and you should not. A practical order of events looks like this:

1. Start with your most important account, which for most businesses is Microsoft 365. Enabling passkeys there protects email, files and the identity everything else hangs off.
2. Prioritise your highest-risk people, such as owners, finance staff and anyone with administrator access. These are the accounts attackers want most.
3. Set up recovery properly before you rely on passkeys, so nobody gets locked out.
4. Roll out gradually to the rest of the team, keeping passwords as a fallback until passkeys cover the services you use.

Done in that order, the change is smooth, and each step leaves your business measurably safer than the day before.

The bottom line

Passkeys are not hype. They are a mature, well-supported technology that removes the single most exploited weakness in modern business security: the humble, stealable password. For Australian firms holding sensitive client information, moving in this direction is one of the highest-value security improvements available, and it happens to make signing in faster and less annoying for everyone.

If you would like a hand working out which accounts to move first and how to do it without disrupting your team, our IT security service is built for exactly this kind of practical, low-fuss improvement. Feel free to get in touch for a quote and we will map out a sensible plan for your business.

Adam Dodds

Adam leads the Itopia team in Brisbane, helping professional-services firms get secure, productive and confident with their technology, in plain English.