For thirty years the advice about passwords has been getting worse: make them longer, make them weirder, change them constantly, never reuse one. The result is that most people now juggle dozens of accounts secured by some variation of the same three passwords, which is exactly the outcome all that advice was meant to prevent.
There is finally a real fix, and it is already sitting on the device you are reading this on. It is called a passkey.
What a Passkey Actually Is
A passkey replaces your password with your device’s own lock screen. When you sign in to a website that supports them, instead of typing anything, you confirm with your fingerprint, your face, or your PIN. That is the entire experience from your side.
Behind the scenes, your device holds a secret key that never leaves it, and the website only ever stores the matching public half. The website proves you are you without ever knowing a password, which means there is no password for anyone to steal, guess, or leak.
Why This Is Genuinely Better, Not Just Newer
Two things make passkeys a meaningful upgrade rather than a lateral move.
First, a passkey cannot be phished. A passkey is mathematically tied to the exact website it was created for. If you land on a convincing fake login page, your device simply will not offer the passkey, because the address does not match. Compare that to a password, which you can be tricked into typing anywhere, or even a texted code, which you can be tricked into reading aloud to someone on the phone.
Second, there is nothing on the company’s end worth stealing. When a company you use gets breached and passwords leak, the danger is that you reused that password elsewhere. A passkey breach leaks public keys, which are useless on their own.
Setting One Up
You do not need to convert your entire digital life at once. Start with the account that controls everything else, which for nearly everyone is their primary email address, because that is where every “reset my password” link lands.
Look in your account’s security settings for “Passkeys” or “Sign in without a password.” Google, Microsoft, and Apple accounts all support them, as do PayPal, Amazon, eBay, and a growing list of banks and business tools. The setup is usually two clicks and a fingerprint.
Your passkeys sync through whatever ecosystem you already use: iCloud Keychain on Apple devices, Google Password Manager on Android and Chrome, Windows Hello on a PC. Most third-party password managers now store them too, which is the better route if you use a mix of platforms.
The Questions Everyone Asks
What if I lose my phone? Because passkeys sync to your account rather than living on one device, a new phone signed in to your account gets them back. It is worth setting up passkeys on two devices anyway, the same way you would keep a spare key to your office.
Do I have to delete my password? No, and at first you should not. Most sites keep the password as a fallback while you get comfortable. Once you are confident, removing the password entirely is what closes the door on phishing for good.
Does everything support this? Not yet. Plenty of sites, especially smaller vendors and older business software, still want a password. For those, a password manager generating long random passwords remains the right answer. Passkeys and password managers are partners here, not competitors.
What This Means for a Small Business
If you have staff, the accounts worth protecting first are the shared ones: your business email, your website’s admin login, your domain registrar, and your payment processor. Those four are the crown jewels, and they are what an attacker goes looking for.
We have moved our own logins to passkeys and hardware security keys, including the administrator account on this website, and the day-to-day experience is genuinely faster than typing a password. Fewer resets, fewer lockouts, fewer sticky notes.
If you would like a hand working out which of your business accounts should be locked down first, get in touch and we will walk through it with you.