A passkey is a new way to sign in to accounts that replaces the traditional username and password. Instead of typing in credentials, you approve sign-in with the same method you already use to unlock your device, like a fingerprint, face scan, or PIN. Passkeys are built on an industry standard from the FIDO Alliance, and they're designed to be both easier to use and significantly harder to steal than passwords. This article covers what passkeys are, how they work, and answers to the most common questions we hear about them.
Visit Hudu Password Manager and Password Management for additional information on managing credentials in Hudu.
What is a passkey?
A passkey is a login credential made up of two mathematically linked pieces: a private key and a public key. The private key stays on your device or in your password manager and is never shared with anyone. The public key is handed to the website or app you're signing in to. Because the two keys work as a pair, a site can confirm it's really you without ever seeing or storing anything secret.
This is a meaningful shift from passwords, which are shared secrets that have to be typed, remembered, and kept safe from anyone who might intercept or guess them. A passkey removes that shared secret from the equation entirely, so there's nothing to memorize and nothing for an attacker to steal from a breached database.
How passkeys work
Creating a passkey
When you set up a passkey for an account, your device generates the public and private key pair on the spot. You confirm the setup with your device's built-in security, such as a fingerprint, face scan, or PIN. The private key is stored securely on your device or in a password manager, and the public key is sent to the website or app.
Signing in with a passkey
When you return to sign in, the site sends a one-time challenge to your device. You approve it the same way you created the passkey, with a fingerprint, face scan, or PIN. Your device uses the private key to answer the challenge, and the site checks the response against the public key it already has on file. If they match, you're signed in. Your biometric information never leaves your device and is never seen by the website.
Why use passkeys
Passkeys offer real advantages over passwords on both the security and convenience side.
Phishing resistant. A passkey only works on the exact website or app it was created for. Even if someone tricks you into visiting a lookalike site, your device won't offer up the passkey, because the domains don't match.
Nothing to steal in a breach. Since only the public key is ever stored on a company's servers, a data breach can't expose anything an attacker could use to sign in as you.
No weak or reused credentials. Every passkey is generated uniquely for one account, so there's no risk of a weak, guessable, or reused password.
Faster and simpler sign-in. There's nothing to type or remember. Signing in is just a biometric check or device PIN, the same motion you already use dozens of times a day.
Passkey support is coming to the Hudu Password Manager in v2.45, letting you create and store passkeys alongside your other credentials. A dedicated how-to article will be linked here once it's published.
FAQ
Not yet, and not everywhere. Adoption is growing quickly, with many major services now offering passkeys as a sign-in option, but plenty of sites still rely on passwords alone. You'll likely use both for a while, and many services let you keep a password as a backup even after adding a passkey.
If your passkeys are stored in a password manager that syncs across devices, you can sign in from another device where that password manager is installed. If a passkey is tied to a single device or hardware security key with no sync, you'll need to use an account recovery option or set up a new passkey from another trusted device.
Passkeys are designed to resist phishing because your device will only present a passkey to the exact site it was created for, so a fake or lookalike site simply won't receive it. The private key also never leaves your device, so there's no secret in transit for an attacker to intercept.
No. Only the public key is stored on the website or app's servers. The private key, which is the piece required to actually sign in, stays on your device or in your password manager.
Yes, if your passkey is stored in a password manager that syncs across devices, it will be available anywhere you're signed in to that password manager. Passkeys stored only on a single device or hardware security key won't automatically carry over to your other devices.
Two-factor authentication is an extra step added on top of a password. A passkey replaces the password itself, and it already combines something you have (your device) with something you are or know (your biometric or PIN), so it functions as multi-factor authentication in a single step.
No. Most modern phones, tablets, and computers already have what's needed built in. Passkeys can also be stored on a dedicated hardware security key if you prefer that option.