Are passkeys more secure than passwords?

Passkeys offer stronger protection than passwords against remote attacks and phishing, but they bring new concerns about access to devices and dependence on a platform, according to TechRadar’s Mark Gill.

Passkeys use a cryptographic key pair: a public key stored on a website’s servers and a private key kept on the user’s device. During login, the device proves the user’s identity without transmitting the private key. Because there is no password to enter, attackers cannot steal it through a fake login page in the usual way.

Most passkeys are unlocked by authenticating on a phone or computer with a fingerprint, facial scan or PIN. The article says biometric scans stay on the device and unlock a secure chip that holds the private key; Apple, Google and Microsoft do not see the biometric template.

Physical access remains a risk. Someone with a user’s unlocked device and screen lock PIN could potentially access accounts protected by passkeys, although most devices require re-authentication for each login attempt, Gill writes.

Passkeys can also be tied to a platform, making a move between ecosystems such as iPhone and Android difficult if passkeys have not been exported. Gill concludes that passkeys are an upgrade over passwords, while noting that device security and platform dependence still matter.