Passkeys vs. passwords: Which is better?

The report explains that a traditional password is a text-based secret code authenticated through hashing. Websites are expected to store a scrambled version of the password, not plain text, and may add a random string of data, or "salt," to make unique hashes even for identical passwords. Passkeys use two cryptographic keys instead: a public key stored by the website and a private key kept on the user's device. To log in, the site asks the user to confirm using the passkey stored on their phone or PC, which is protected by the device's existing authentication method, such as Face ID, Windows Hello PIN, or a fingerprint scanner.

Engadget draws an analogy: public and private keys are like a locked mailbox. Anyone can drop in a message asking for proof of identity, but only the owner's key can unlock it to authenticate. In the case of passkeys, additional layers ensure the device key is safely kept behind biometrics and is engineered to never work on a phishing site.

The report notes that passwords have long been problematic because users often reuse weak credentials across services and can be tricked into entering them on fake websites. Password managers help with some of these issues but have drawbacks: users can store weak passwords, paste credentials into imposter sites, or forget the master login. Passkeys address the root problems: they cannot be weak, they are tied to a specific domain, and they cannot be reused or handed over on a malicious page. They also satisfy the "something you have" and "something you know or are" checks simultaneously, reducing the need for traditional two-factor authentication. In a data breach, passkeys offer nothing to steal because public keys are already public.

However, Engadget emphasizes that passkey storage requires care. Since passkeys are tied to a device or software rather than something remembered, users risk being locked out if they lose access to the stored passkey. It is also less straightforward to share a passkey than to give away a password. The report advises setting strong lock screen security on phones and computers, warning that a PIN like "1234" should not be the only gate to all logins.

For users who want to get started, Engadget recommends opening the security or login section of an online account and looking for a passkey option. Services supporting passkeys usually guide users through creation. Storage defaults include Apple's Passwords app on macOS and iOS, Google Password Manager on Android, and Windows 11 keeps passkeys on the device under Settings > Accounts > Passkeys.