For thirty years the password has been the weak seam in almost every breach. People reuse them, attackers phish them, and no amount of complexity policy has fixed the underlying problem: a password is a shared secret that both you and the server know, which means it can be stolen, guessed, or tricked out of you. Passkeys — built on the open WebAuthn and FIDO2 standards — remove that shared secret entirely. In 2025 they stopped being an experiment. Microsoft made passkeys the default sign-in for new consumer accounts, Apple added credential portability with iOS 26, and more than a billion people have now activated at least one passkey.

How a passkey actually works

When you create a passkey, your device generates a public/private key pair. The private key never leaves the secure hardware on your phone, laptop, or hardware key — it is not typed, transmitted, or stored on the server. The website keeps only the public key, which is useless to a thief on its own.

Signing in is a challenge-response exchange. The server sends a random challenge; your device signs it with the private key after you approve with a fingerprint, face, or PIN; the server verifies the signature against the public key it holds. There is no secret in transit that an attacker can capture and replay. In WebAuthn terms this is the authentication ceremony, and the browser API (navigator.credentials.get()) does the heavy lifting.

Why this beats passwords against phishing

The property that matters most for security is origin binding. Every passkey is cryptographically tied to the exact domain it was created for, and the signed data includes that origin. A passkey for yourbank.com simply will not produce a valid signature for yourbanc.com — the browser refuses to offer it. This is a structural defence, not a warning the user can click past.

Contrast that with the failure modes we see in real engagements. A convincing fake login page harvests a password and a one-time SMS code, then replays both against the real site within seconds. Passkeys break that entire chain: there is no reusable secret to harvest, and the credential itself will not fire on the wrong domain. CISA, NIST, and the major identity vendors all classify passkeys as phishing-resistant for this reason.

Synced vs. device-bound

Two flavours are worth understanding:

  • Synced passkeys replicate across your devices through a provider such as iCloud Keychain, Google Password Manager, or a password manager. If you lose a phone, the credential survives. This is the right default for most staff.
  • Device-bound passkeys — typically on a hardware security key — never leave the original device. They offer the strongest assurance and suit privileged or administrator accounts, at the cost of needing a registered backup key.

Practical adoption for a small business

The good news is that you rarely need to build anything. The identity platforms you likely already use — Microsoft Entra, Google Workspace, Okta, and many others — ship passkey support you can switch on. A rollout that once took months is now a matter of configuration. A sensible path:

  • Start where the identity lives. Enable passkeys in your primary identity provider first, since that account usually unlocks everything else.
  • Pilot before you mandate. Enrol a small group, confirm the experience on the devices your team actually uses, then widen. Be aware that desktop sign-in on Windows can still be less smooth than on mobile; test it rather than assume it.
  • Fix your recovery paths first. This is where most of the security is won or lost. A passkey deployment that still allows a fallback to an SMS code or an emailed reset link quietly re-opens the phishing door you just closed. Inventory every way a user — or an attacker — can authenticate, and make sure the recovery route is at least as strong as the front door.
  • Protect the privileged accounts hardest. For admins and finance, prefer device-bound hardware keys with a registered spare, not just a synced credential.
  • Explain the why. The organisations that stumble almost always deployed without telling people what problem passkeys solve. A short, honest explanation earns cooperation.

A measured conclusion

Passkeys are not magic, and passwords will linger in the long tail of legacy systems for years. But for the threat that costs small businesses the most — someone tricked into handing over credentials on a convincing fake page — passwordless authentication is a genuine, standards-based fix rather than another layer of friction. If you do one security project this year, moving your most important accounts to passkeys is a strong candidate. Start small, get recovery right, and let the cryptography do the work the password never could.