Passkeys vs. passwords: which one keeps your accounts safer
More online services now let users set up passkeys instead of traditional passwords, since passkeys address several long-standing security weaknesses. Still, the technology isn't supported everywhere and requires new habits from users.
A growing number of online services now offer passkeys as an alternative to traditional passwords. While passwords remain familiar, they carry several security weaknesses, and passkeys offer a stronger option — though not every website supports them yet.
How each method works
A password is a text string that websites store not in plain form but as a scrambled version, or hash, created through a one-way function. When a user enters the correct password, the system compares its hashed version to the one stored in the database. Passkeys work differently, relying on a pair of keys: a public key kept by the website and a private key stored on the user's device. When logging in, the website requests confirmation through the device-held key, which the user unlocks with face recognition, a fingerprint, or a PIN. This means nothing needs to be memorized.
Why passkeys are considered safer
Despite the convenience of password managers, they don't solve every problem — users can still choose weak passwords or fall for phishing attempts. Passkeys address these issues at their root: they can't be "weak," they're tied to a specific domain so they can't be entered on a fake site, and in the event of a data breach, attackers have nothing to steal since the public key is already meant to be public.
Getting started
To create a passkey, users can open their account's security settings and enable the relevant option if the service supports it. Apple devices store passkeys in the Passwords app, Android uses Google Password Manager, and Windows 11 keeps them under system settings. Linux currently lacks native support. Using a separate password manager is still recommended, especially for people who use devices from different ecosystems, since it makes signing in across platforms easier. Depending on the service, a passkey may either replace or supplement a password.
