Passkeys and Passwordless Authentication

The future of authentication is arriving, and it doesn’t involve passwords at all. Passkeys — built on the FIDO2 and WebAuthn standards — replace passwords with cryptographic key pairs that are phishing-resistant by design. For business leaders, passwordless authentication represents a significant opportunity to eliminate entire categories of credential-based attacks while improving the user experience for employees and customers alike.

How Passkeys Work

When you create a passkey for a website or application, your device generates a unique cryptographic key pair. The private key never leaves your device — it is stored securely in the hardware security module of your phone, laptop, or security key. The public key is shared with the service. To authenticate, you simply unlock the passkey using your fingerprint, face, or device PIN. No password is transmitted, stored on a server, or vulnerable to phishing.

This approach eliminates the most common attack vectors against credentials. There is nothing to phish because no secret is shared during authentication. There is nothing to stuff because there are no passwords to reuse. There is nothing to brute-force because the cryptographic keys are computationally unbreakable with current technology.

• Phishing resistance: Passkeys are bound to the specific domain they were created for — a fake login page cannot intercept them.
• No shared secrets: The private key never leaves the device, so server breaches don’t expose credentials.
• User convenience: Authentication is a single biometric gesture — faster than typing a password and entering an MFA code.
• Cross-device sync: Modern platforms sync passkeys across your devices through encrypted cloud storage.

Adoption Strategy for Businesses

Transitioning to passwordless authentication doesn’t happen overnight. Most organisations will run passwords and passkeys in parallel during a transition period. Start by enabling passkeys on services that support them — many major platforms including Microsoft 365, Google Workspace, and popular SaaS applications now offer passkey support. Prioritise high-risk accounts and gradually expand coverage.

Action Steps

1. Inventory passkey-ready services: Identify which of your current applications and platforms support FIDO2 or passkey authentication.
2. Pilot with IT and security teams: Let technically confident staff trial passkeys first and document the experience.
3. Provide hardware security keys: For high-privilege accounts, issue physical FIDO2 security keys as the most secure passkey storage option.
4. Update authentication policies: Revise your security policies to recognise passkeys as an approved — and preferred — authentication method.
5. Educate employees: Explain what passkeys are, how they differ from passwords, and why they are more secure in plain, non-technical language.