Article Read Time
Passkeys are the hot topic in cyber security. In May 2025, Microsoft also stopped asking people opening a new account to create a password. This spring, however, the FIDO Alliance, the passkey standard’s author, estimated about 5 billion passkeys were in use worldwide. Moreover, passkeys are now a standard sign-in option for Microsoft, Google, and Apple accounts used by many small offices.
As a result, many owners, clerks, and non-profit directors have questions about passkeys. They wonder what a passkey is, whether it is safe, and whether it will last. In plain terms, a passkey is a stronger kind of login. It is safer than nearly any password. It rests on an open standard built into phones, computers, and browsers by the largest technology companies.
What are passkeys?
Passkeys are digital credentials that replace a password. A passkey is stored on your phone, computer, or a small device called a security key. You unlock it the same way you unlock that device: with a fingerprint, a face scan, or a short PIN. Passkeys require nothing to memorize or type. They remove habits that weaken passwords. Reuse across accounts, sticky notes on monitors, and typing them into fake login pages.
How passkeys work
Passkeys have two matching pieces of code, called keys. Your private key remains on your device and never leaves it. The website stores only the public key. Anyone who steals the public key from the company’s servers can’t use it. At sign-in, the website sends a one-time challenge. Your device answers with the private key after you confirm with a fingerprint or PIN. The website verifies the answer against the public key on file.
Passkeys are also tied to the real address of the website that created it. If an employee clicks a link to a fake Microsoft login page, they find no passkey for that address. CISA ranks this login as one of the strongest defenses against phishing.
Why a four-digit PIN can beat a 12-character password
Four digits on a phone unlock the passkey. A small key opens the drawer where the house keys are kept. By contrast, a 12-character password works from anywhere in the world. Anyone who guesses it can use it from any computer. Someone can buy it from a breach list or trick someone into typing it.
A PIN works only on the device in your hand. It never travels over the internet, and most devices lock after several wrong guesses. To use that PIN, a criminal would first need to steal the device itself. This requirement is a much higher bar than buying a password online. A fingerprint or a six-digit PIN is still the better choice, and no work phone should open with a birthday or 1234.
A lasting change, with gaps to close
Passkeys are built on open standards from the FIDO Alliance and the World Wide Web Consortium, the body that sets the rules for how websites work, and Apple, Google, and Microsoft all support them. The FIDO Alliance’s Passkey Index, published October 15, found that passkey sign-ins succeeded 93% of the time, compared with 78% for traditional sign-ins that use a second login step.
Passkeys do not close every door, though. In a recent SecurityWeek column, security executive Torsten George noted that attackers who cannot steal a passkey will turn to the steps around it, especially account recovery after a phone is lost. If that fallback is a text message code, an emailed link, or a call to the help desk, it becomes the easiest way in.
How a small organization can start
You can do the work in stages, and most of it uses tools an office already pays for.
- Start with the accounts that matter most, such as banking, payroll, and the Microsoft 365 or Google Workspace accounts that run the office.
- Store everyday passkeys in Apple, Google, or a business password manager, and give administrators hardware security keys, which typically cost $25 to $80.
- Set up a backup for every important account, such as a second passkey on another device or a spare security key kept in the office safe.
- Require the help desk or IT provider to call back at a number already on file before resetting anyone’s access.
- Remove the old password once a passkey works, where the service allows it, and keep any remaining password long, unique, and in a password manager.
- Give staff 15 minutes to review what the passkey prompt looks like, and the rule that no real service asks them to read a code aloud over the phone.
Where Commonwealth Sentinel fits
Commonwealth Sentinel helps small businesses, local governments, and non-profits across the Commonwealth plan changes like this one, from choosing security keys to writing a recovery process staff can follow. Anyone who wants to talk through where to begin can reach us at 502-234-5554.
A password is a secret anyone can repeat, while passkeys are a key someone has to hold, and that difference is what keeps an office’s doors locked.