A passkey is a login credential that replaces the password with a cryptographic key pair: the public half is registered with the service you log into, the private half never leaves the employee's device, and sign-in is unlocked with a fingerprint, face scan or PIN. Because the private half never travels, there is nothing for a phishing page to steal — which is why passkeys are the technology behind what security agencies call phishing-resistant multi-factor authentication. For a small business, passkeys turn the weakest daily habit (typing a password into whatever page asked for it) into the strongest control you run. The attack classes it starves — credential stuffing and MFA fatigue — are covered in their own guides.
TL;DR
- A passkey replaces the password with a key pair: the public half sits with the service, the private half never leaves the device.
- Sign-in is unlocked locally with a fingerprint, face scan or PIN — no codes, no SMS, no push prompts to mis-approve.
- Passkeys are cryptographically bound to the real website's domain, so a perfect fake login page cannot harvest one.
- The FIDO Alliance standards behind passkeys are what guidance means by phishing-resistant MFA.
- Roll out on email and finance first, write a one-page recovery plan, and train the sign-in habit.
What is a passkey in plain terms?
A password is a shared secret: you hold it, the service holds a hash of it, and every sign-in means sending the secret (or something derived from it) across the network. A passkey replaces that shared secret with two halves of a key pair generated on the employee's device. The service keeps only the public half, which is useless on its own. The private half never leaves the device — it is stored in the device's secure hardware or its credential manager, and it is unlocked by the same fingerprint, face or PIN the employee uses to unlock the phone or laptop.
Sign-in becomes a challenge-and-response exchange: the genuine site sends a one-time challenge, the device signs it with the private key, and the site verifies the signature against the registered public key. Nothing secret crosses the wire, nothing is typed, and nothing can be replayed by anyone who watches the exchange.
How a passkey is set up and used
- Registration happens once. The employee enables a passkey on the service; the device generates the key pair and sends only the public half to register it. Most services let staff register several devices.
- Sign-in is a local unlock. On the real site, the employee confirms identity with the device's biometric or PIN and the signed challenge goes back. Two seconds, no typing.
- Sync or cross-device for new hardware. Passkeys sync through iCloud Keychain, Google Password Manager or the platform credential manager; cross-device sign-in handles a new laptop with a QR scan against the phone.
- Recovery is a plan, not a password. Losing the device does not lock the employee out forever — it triggers the recovery path the business set up: a second registered passkey, recovery codes or an administrator reset.
Why phishing cannot steal a passkey
The mechanism is domain binding. A passkey's private key is created for one specific web origin, and the device only produces a valid signature when the challenge comes from that origin. A criminal can clone the look of your Microsoft 365 login perfectly — the cloned page is still not login.microsoftonline.com, so the device refuses to sign. The FIDO Alliance, which publishes the standards behind passkeys, describes them explicitly as phishing-resistant authentication (fidoalliance.org/passkeys).
That closes the gap every other credential leaves open:
| Credential | What a fake login page collects | What an MFA-fatigue attack gets |
|---|---|---|
| Password | Everything — the account opens | The whole account once a prompt is approved |
| SMS or app code | A code that replays in real time | The account via a tired tap-through |
| Push approval | Nothing directly — until approved | The whole account |
| Passkey | Nothing — the signature is domain-bound | Nothing to prompt for |
Password spraying, credential stuffing and MFA fatigue all feed on typed secrets. A passkey removes the food supply, which is why agencies frame phishing-resistant methods as the destination for high-value accounts.
What passkeys do not fix
- Device loss needs a recovery plan. The passkey lives on the device, so the business needs the reset path documented before the first laptop goes through an airport.
- Shared and kiosk devices are a poor fit. A passkey is personal; a shared front-desk login still needs a managed alternative.
- Other attack channels keep running. Passkeys stop credential phishing. Invoice fraud, fake supplier emails and phone scams do not involve a login at all — monthly training still carries those.
- Not every service supports them yet. Coverage is broad and growing across email, finance and password managers, but legacy line-of-business tools may need MFA on a code or key until they catch up.
How to roll out passkeys in a small business
- Start with the identity provider. Microsoft 365 and Google Workspace both support passkeys today; enabling them for email protects the account every other password reset flows through.
- Register a second method during transition. Each employee keeps a backup credential registered, so a dead phone battery is an inconvenience, not a lockout.
- Write the one-page recovery plan. Who resets what, how identity is confirmed, and what happens the day a device is replaced. Thirty minutes now saves the panicked Monday later.
- Train the habit once. One short module: what the passkey prompt looks like, when to approve it, and that a passkey prompt for a site they never registered is a red flag to report. Security awareness training carries the password and MFA modules; passkeys slot into the same lesson.
- Extend to finance, then everything that supports them. Accounting, payroll, banking and the password manager vault come next — then the rest of the stack as vendors add support.
- Find the gaps first. A security gap assessment shows which logins still run on passwords alone — exactly where passkeys (or interim MFA) go first.
FAQ
What is a passkey in simple terms? A replacement for the password that stays on your device: sign-in is unlocked with your fingerprint, face or PIN, and the credential cannot be phished because it only works on the genuine website.
Are passkeys the same as a password manager? No. A password manager stores passwords so staff stop reusing them; a passkey removes the password entirely. They work well together — the manager vault holds the passkeys for services that use them.
Can a passkey be phished or intercepted? The private key never crosses the network and only signs challenges from the exact domain it was created for. A perfect fake login page gets nothing. The phishing that remains targets the recovery path, which is why the recovery plan matters.
What happens if the device with the passkey is lost? The business recovery path applies: the administrator resets the credential after verifying identity, and the employee re-registers a replacement device. This is a documented process, not a password reset email.
Do passkeys work across devices? Yes. Passkeys sync through iCloud Keychain, Google Password Manager or the platform credential manager, and cross-device sign-in unlocks a new computer with a QR scan against the phone.
Should a small business move to passkeys in 2026? Yes, starting with email and finance where support already exists. Where a service does not offer passkeys yet, keep MFA on and prefer app-based or hardware-key methods until it does.
One last thing
Spend ten minutes this week counting how many of your business logins offer a passkey or security-key option — in Microsoft 365 and Google Workspace the setting is already there, waiting in the security menu. Every login you convert removes one phishable secret from the business permanently.