What are passkeys, and should your business use them?
Passwords are still one of the weakest points in most organisations. People reuse them, forget them, write them down, and sometimes type them into very convincing fake login pages. Passkeys are designed to remove that problem.
Source: NCSC passkeys guidance.
What is a passkey?
A passkey replaces your password with your device’s own security.
Instead of typing a password, you prove it is you in the same way you unlock your device: a fingerprint, face scan or PIN.
When you set up a passkey for a website or app, your device creates two matching keys. One is private and stays protected on your device. The other is public and is stored by the service you are logging into.
When you sign in, the website sends a challenge. Your device can answer that challenge only after you unlock the passkey locally. The website never sees a password because there is not one.
That is the clever bit. There is nothing for a fake login page to capture, and nothing useful for an attacker to reuse somewhere else.
Why passkeys are harder to attack than passwords
A password is a secret you share with a website every time you log in.
That is exactly what attackers go after. They try to steal it, guess it, buy it from a breach, or trick someone into typing it into the wrong page.
Passkeys work differently.
- They are resistant to phishing.
A passkey is linked to the real website it was created for. If someone lands on a fake login page, the passkey will not work there. - There is no password list to steal.
The website stores a public key. That is not useful on its own. The private key stays on the user’s device or in their trusted credential manager. - They remove password reuse.
Each passkey is unique. One compromised website does not give an attacker a password they can try everywhere else. - They are quicker for staff.
Instead of typing a password and then waiting for a code, staff can usually sign in with the same gesture they already use to unlock their device.
Sources: NCSC passkey security assessment and Microsoft Entra passkeys guidance.
Where can you use passkeys already?
Passkey support is growing quickly.
Apple, Google and Microsoft have built passkeys into their phones, laptops, browsers and account systems. Microsoft 365 supports passkeys through Microsoft Entra, including security keys and device-based options.
Many password managers, banks, online services and business tools now support them too, although you should expect a mixed picture for a while. Some older systems will still need passwords.
For most small organisations, this is not an overnight switch. It is a staged move away from passwords, starting with the accounts that would cause the most damage if they were compromised.
Synced passkeys and security keys: what is the difference?
There are two broad types of passkey worth understanding.
Synced passkeys
A synced passkey is stored in a trusted account or credential manager, such as Apple, Google, Microsoft or a password manager.
The advantage is convenience. It can work across multiple devices and is less likely to lock someone out if they replace their phone or laptop.
Device-bound passkeys
A device-bound passkey stays on one physical device, such as a hardware security key.
This can be a stronger option for sensitive accounts because the key cannot simply sync across devices. It is a common choice for administrators, owners and finance staff.
The right answer depends on the risk. Convenience matters, but so does protecting the accounts that can move money, change systems or access sensitive data.
Where YubiKeys fit in
A YubiKey is a small physical security key that can be used for strong multi-factor authentication and passwordless sign-in.
Instead of relying on a code sent by text message or an approval prompt that can be tricked out of someone, the user signs in by physically touching or tapping the key. The login is tied to the real website, which makes it much harder to phish.
For a small business, YubiKeys make most sense for the accounts you really do not want to lose control of:
- Microsoft 365 global administrator accounts;
- owner and director accounts;
- finance and payroll accounts;
- password manager admin accounts;
- domain registrar and DNS accounts;
- backup and security platform admin accounts.
YubiKey USB-C
A good starting point for adding a hardware-backed passkey or security key to sensitive accounts.
YubiKey USB-A
Another option for businesses that want a physical security key for passwordless sign-in or stronger MFA.
Important: buy at least two keys for critical accounts. Keep one as the main key and store the second as a spare. A security key is brilliant until the only one you have goes through the washing machine or disappears into the same place as USB sticks and odd socks.
Source: Yubico YubiKey overview.
Should your business use passkeys?
For most businesses, yes.
But that does not mean switching everything off on Friday afternoon and hoping Monday morning goes well.
Passkeys are best introduced carefully, starting with the accounts where the risk is highest.
- Start with administrators, owners, finance users and anyone who can move money or change security settings.
- Make sure each person has a backup method, such as a second device or spare security key.
- Test the process with a small group before rolling it out to everyone.
- Keep passwords and existing MFA in place during the transition where needed.
- Document the recovery process so nobody gets locked out when a phone is lost or replaced.
The aim is not to make life complicated. The aim is to remove one of the easiest ways attackers get in.
What to watch out for
Passkeys are a big improvement, but they are not magic.
- Account recovery needs planning.
If someone loses the only device or key linked to an account, they may be locked out. Set up backup passkeys or spare security keys before you need them. - Not every system supports them yet.
Some services will still use passwords, so your business will probably run both methods side by side for a while. - Shared accounts need fixing.
Passkeys are tied to a person and a device. If your team still uses shared logins, passkeys are a good reason to tidy that up. - Phones and devices still need protecting.
A passkey is only part of the picture. Devices should still be updated, encrypted and protected with a strong PIN or biometric unlock.
Frequently asked questions
What is a passkey in simple terms?
A passkey is a way to log in using your fingerprint, face or PIN instead of a password. Your device proves it is you to the website, and no password is typed or stored by the website.
Are passkeys safer than passwords?
Yes. Passkeys are resistant to phishing, cannot be reused across sites, and do not create password lists for attackers to steal in a data breach.
Does Microsoft 365 support passkeys?
Yes. Microsoft Entra supports passkeys, including options using Microsoft Authenticator, device passkeys and FIDO2 security keys.
Do passkeys replace MFA?
A passkey can act as multi-factor authentication because it combines something you have, such as your device or security key, with something you are or know, such as your fingerprint, face or PIN.
Should every member of staff have a YubiKey?
Not always. For many teams, synced passkeys on managed devices may be enough. YubiKeys are especially useful for high-risk accounts such as administrators, owners, finance users and accounts that control domains, backups or security settings.
What happens if someone loses their passkey device?
That depends on how it was set up. Synced passkeys may be available on other trusted devices. Device-bound passkeys, such as hardware keys, need a spare key or recovery process. This is why backup planning matters before rollout.
Final thought
Passwords have done a long shift, but they are tired.
Passkeys are faster, safer and much harder to trick out of someone. For most small organisations, the sensible move is not to wait until passwords disappear completely. It is to start with the accounts that matter most.
Protect the admin accounts. Protect the money-moving accounts. Protect the accounts that could sink the ship if they were taken over.
Then build out from there.
