Passkeys Explained: Why They Are Safer Than Passwords

What exactly is a passkey?

Imagine having a digital key that works for one website and cannot be reused at a convincing lookalike website. A passkey is an authentication credential built on FIDO standards and public-key cryptography. The service keeps a public key; the corresponding private key is protected by your device or passkey provider.

When you sign in, the private key responds to a challenge from the legitimate website without being transmitted to it. You approve the sign-in by unlocking your trusted phone, computer, password manager, or hardware security key.

Your fingerprint, face scan, or device PIN typically unlocks the credential locally. The website does not receive your face image or fingerprint. Depending on the type, a passkey may stay on one device or synchronize securely through a passkey provider.

What signing in with a passkey looks like

1. Open the settings of a website or app that supports passkeys, and choose to create a passkey for your account.
2. Choose a trusted phone, computer, supported password manager, or FIDO2 hardware security key to store it. Approve the setup with your usual device unlock.
3. The site saves the public key associated with your account; your chosen passkey provider protects the corresponding private key.
4. At your next sign-in, choose Sign in with a passkey, unlock the authenticator, and allow it to answer the real site's cryptographic challenge. There is no password to type.

Microsoft provides step-by-step instructions in Create and save a passkey. The exact prompts depend on the site, operating system, browser, and your organization's policies.

Why use a passkey instead of a password?

A passkey can also provide multi-factor authentication in a single sign-in when it combines possession of an authenticator with local PIN or biometric verification. But adding a passkey does not automatically remove weaker password or recovery routes. Those other paths still need attention. See NIST's authentication guidance.

Where does the passkey live?

Synced passkey

Stored in a compatible credential manager and available across devices connected to the provider, typically through encrypted synchronization. This can be convenient for employees with multiple devices or a new phone. Protect the provider account and its recovery process, because they become important parts of your security.

Device-bound passkey

Remains tied to a particular device or physical security key instead of being copied to other devices. That separation can give organizations stronger control over where credentials exist, but it increases enrollment and recovery work.

Microsoft Entra's passkey guidance recommends synced passkeys for many everyday users and device-bound options for highly privileged users. Neither approach is right for every environment.

Example: the fake Microsoft 365 password-expiration email

An employee receives a message claiming their Microsoft 365 password will expire today and must be updated. With password-based sign-in, they may type that password into a forged page. If their account requires a FIDO2/passkey sign-in, the attacker's lookalike domain cannot obtain the valid cryptographic response for the real Microsoft sign-in service.

This is an illustrative scenario, not a reported Blue Tree Technology® customer incident. It demonstrates why phishing resistance matters, but it does not mean every passkey-enabled account has had all weaker sign-in routes disabled.

Related reading: Why Microsoft Recommends Passwords That Don't Expire.

What passkeys do not fix

• Malware on a compromised or unlocked computer, and attackers who have already stolen an active application session.
• Weak password, help-desk, or account-recovery methods that remain available as an alternative.
• Devices that other people can unlock, or passkeys created on shared or untrusted equipment.
• Legacy applications that do not support passkeys, or company policies that restrict how credentials can be stored.
• Confusing cross-device prompts or losing access to a passkey provider without a tested recovery plan.

Passkeys are a substantial improvement to authentication, not a replacement for endpoint security, access reviews, or incident response.

How to get started without disrupting employees

1. Start small. Choose one valuable, passkey-compatible account for a pilot. Microsoft work accounts may require an administrator to enable the sign-in method.
2. Choose approved storage. Use a managed device or approved passkey provider with a protected screen lock and strong account recovery.
3. Register the passkey. Find the account's sign-in or security settings and follow its Create/Add passkey prompts. For Microsoft work or school accounts, start with your Security info page when permitted by company policy.
4. Test a real sign-in. Check the new method on devices employees use, and verify backup access before removing older methods.
5. Plan the exceptions. Document what happens when a phone is lost, an employee leaves, a device is replaced, or somebody needs urgent account recovery.

Google's passkey setup guidance also explains account and device requirements. Registering a passkey does not necessarily disable password sign-in automatically.

Who should use which method?

Typical employees: a supported synced passkey is often a practical starting point. Privileged administrators, finance users, and sensitive accounts: a device-bound passkey or dedicated hardware key may provide more control. Do not apply the same requirement to every employee before validating compatibility, accessibility, and recovery.

For physical-key tradeoffs, see Hardware Security Keys: Why Use a YubiKey—and When Not To.