What Is A Passkey?
You may have noticed web sites or online services turning towards passkeys. Passkeys will soon become the default authentication option for Microsoft 365 as well. What is a passkey?
Historically access to services has been via username + password. The problem? Anyone with your username and password can log in. Sure, there are ways to limit that, such as limiting connections by location (IP address), or multi-factor authentication (MFA).
A passkey looks deceptively simple but is actually rather complex underneath. Like a password, your account has a secret encryption key that can identify you. However, with a passkey, the "relying party" (your bank's web site) does not know your secret. You also do not know this secret. In order to sign in, you just need to prove that you have that secret. This makes the secret impossible to accidentally share with a hacker. Passkeys are based on public/private cryptography, which is a fancy way of saying only someone with the private key (you) can send encrypted messages to someone with the public key (your bank). Web servers use this to send encrypted content to your browser.
Passkeys can be stored in Windows, typically protected with a PIN, password, or biometric verification, or a variety of apps, such as a password manager, to decrypt them. Microsoft added passkeys to their Microsoft Authenticator app, for instance.
From your perspective, you simply click "sign in with passkey," enter your PIN, and the software takes care of all the background communication to verify you are the person logging in, with an approved device.
October 2026
Send this article to a friend!
Subscribe to The ITS Connection
Related articles