If you recently signed in to a Google, Apple or Microsoft account, you may have been offered to 'create a passkey'. Most people skip it, but it is worth a moment: passkeys are probably the biggest change in how we sign in online since the password was invented, and they solve most of its problems.
The problem with passwords is well known. People choose easy ones, reuse the same password across sites, and passwords leak in breaches. The biggest problem is phishing: a fake site that looks exactly like your bank or Gmail, where you type your password yourself. Once the scammer has it, they can use it from anywhere.
A passkey works differently. Instead of a password you remember and type, a pair of digital keys is created: a private key stored only on your device and a public key stored by the site. When you sign in, the site sends a 'challenge' and your device signs it with the private key after you approve with a fingerprint, face or phone PIN. The private key never leaves the device, so there is no password to steal.
The big advantage is phishing protection. A passkey is tied to the site's real address. If you land on a fake site impersonating your bank, your device simply will not offer to sign in, because the address does not match. So even if you fell for a fake message and clicked a link, there is nothing for the scammer to steal. That is why the big tech companies and security experts recommend moving to passkeys wherever possible.
What if you lose your phone? Passkeys are usually synced through your account, in Apple's iCloud, Google Password Manager or other password managers, so they move to your new phone. Just keep a recovery option for your main account, such as a second device or backup codes. The recommendation: start with your most important accounts, Google, Apple or Microsoft, and continue to other sites that offer the option.
