What is a passkey?
A passkey replaces a password with a pair of cryptographic keys. The private key stays on the user's device (phone, laptop or security key) and never leaves it. Your server only stores the public key. To sign in, the device proves it holds the private key, and the user unlocks it with what they already use to unlock their phone: fingerprint, face or device PIN.
Passkeys are built on the FIDO2 and WebAuthn standards and supported by Apple, Google and Microsoft. They sync across a user's devices through their Apple, Google or password-manager account.
Why passkeys are safer than passwords
- Phishing-resistant: a passkey only works on the real website or app it was created for, so a fake login page can't use it.
- Nothing to steal from your database: you store public keys, which are useless to an attacker.
- No reuse: every passkey is unique to one site.
- No weak passwords: users can't choose "123456".
Why users like them
- Sign in with a fingerprint or face in a second or two.
- Nothing to remember or reset.
- Works across their phone and computer once synced.
Passwords vs one-time codes vs passkeys
| Password | SMS / email code | Passkey | |
|---|---|---|---|
| Phishing-resistant | No | No | Yes |
| Speed for user | Slow (typing, resets) | Medium (wait for code) | Fast |
| Cost to you | Support tickets for resets | SMS fees | No per-login fee |
| Works on any device | Yes | Yes | Most modern devices |
Should you switch?
- Yes, add them, if users log in often (customer portals, SaaS products, banking, fintech, e-commerce accounts).
- Yes, prioritise them, if you handle money or sensitive data, or have had account takeovers.
- Keep a fallback for now. Some users have older phones or shared devices, so offer a passkey as the main option with a secure backup such as an email link or one-time code.
The best rollout is gentle: after a user logs in the normal way, offer "Sign in faster next time with your fingerprint or face". Don't force it on day one.
How to add passkeys
- Using an auth provider? Many identity services now support passkeys with a setting or small code change. Start there.
- Custom login? Use a well-maintained WebAuthn library for your backend rather than writing the cryptography yourself.
- Mobile apps: iOS and Android both have native passkey APIs, and cross-platform frameworks such as Flutter have plugins for them.
- Account recovery: plan what happens when someone loses all their devices. This is the part teams most often forget.
Things to watch
- Explain passkeys in one plain sentence on the login screen; many users still don't know the word.
- Let users see and remove their passkeys in account settings.
- Test on the devices your customers actually use, including mid-range Android phones.
Passkeys make login both safer and faster, which is rare in security. For any app where people sign in regularly, they're worth adding now, alongside a sensible fallback. We build mobile apps and web platforms with modern authentication, including passkeys, M-PESA payments and secure APIs.
See our mobile app development and web development services.
