Passkeys instead of passwords: sign in with your finger – more secure and less nerve-racking

How many passwords have you typed in today? And how many of them are actually the same one with a different number at the end?

Passwords are IT's favourite problem. Too short, reused too often, on sticky notes on the screen or in a spreadsheet called “Passwords_new_final”. And even a good password doesn't help much if someone types it into a fake login page. That's exactly what passkeys are for.

What a passkey is

A passkey replaces the password for a specific account. Instead of typing something in, you confirm the login on your device – with your fingerprint, face recognition or the device PIN. Cryptography works in the background: your device has a secret key, and the service only knows the matching public counterpart. The secret key never leaves your device.

Why it's more secure

The BSI (Germany's Federal Office for Information Security) spells out the advantages clearly: passkeys can't be too short or too simple, and you can't forget them. Phishing becomes much less effective because the secret key is never handed over. Each passkey only works for one account, so misuse doesn't immediately put all the others at risk. And because the provider doesn't store a password, none can be stolen in a data leak.

Passkey, password manager, two-factor – what's what?

The terms often get mixed up. A quick attempt to sort them out:

• Password: something you know. It can be guessed, stolen or typed into a fake site.
• Two-factor login: password plus something you have, such as a code from an app. Much more secure, but a skilled fraudster can simply ask you for the code too.
• Passkey: replaces password and code with a key on your device that you unlock with your finger, face or PIN. It can't be phished – it only works on the genuine site.
• Password manager: a secure vault for all your logins. It creates strong passwords, can store passkeys and make them available across devices.

In everyday use, the four complement each other. Passkeys wherever they're available. Two-factor login everywhere else. And a password manager, so nothing ends up on sticky notes or in spreadsheets any more.

Where things (still) get stuck

Passkeys aren't a cure-all, and the BSI (Germany's Federal Office for Information Security) says so too:

• Device gone? Then you need a backup: syncing via the cloud, a second device or a second security key. Without a backup, the only way back in is via the provider.
• Not every service offers passkeys. Many smaller programs and portals still use passwords – in that case, please with two-factor login.
• Other people's computers: There you sign in with your phone, via QR code and Bluetooth. That works well but takes some getting used to at first.
• Shared accounts in a team – one login for everyone – don't go well with passkeys. To be honest, they don't go well with security either.

How to get started as a team

A good start doesn't take a whole day. Check which of your most important services already offer passkeys – big email, cloud and office services often do. Set up a passkey for each person, plus a backup right away. And write down what happens if a phone gets lost: who blocks it, who helps, how do you get back in?

For company accounts, a password manager that can manage passkeys and share them securely within the team is worthwhile. The advantage: when someone leaves the company, they don't take any logins with them – and nobody has to spend three days searching for who had the password to the domain account. The Lost Monster knows that search all too well.

By the way: the Bundeslagebild Cybercrime (Germany's national cybercrime situation report) also recommends that companies switch on multi-factor login, especially for email, cloud, online banking, accounting and admin access. Passkeys are the most convenient form of it.

Logins gone, scattered or only in a former colleague's head? The Lost Monster gathers them up, sorts them and sets up passkeys with you.