What Is a Passkey and Why Should You Use It?
Key takeaways
- A passkey is a key pair, not a password, so there is nothing for a phishing site to capture and nothing for a user to type into a fake login page.
- Passkeys unlock with a biometric or a device PIN, which is faster for users than a password and removes the shared-password spreadsheet from the workflow.
- The private key stays on the device or in a synced vault, so the credential can be recovered on a new phone without sending anything to support.
- Adoption is easiest where the login already lives on a phone, which in India means email, UPI-linked banking apps and WhatsApp-linked business tools.
- Keep one hardware security key or a printed recovery code as a backup, because a device-bound credential still fails when the device is lost or wiped.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is a passkey and how does WebAuthn actually work?
When you register a passkey, your device creates a public key and a private key. The public key goes to the website, the private key stays on the device, usually inside the platform keystore, a hardware security module or a synced vault. At login, the site sends a challenge, your device signs it with the private key, and the site checks the signature against the public key it already holds. Nothing secret is typed, so a fake login page has nothing to steal. WebAuthn is the browser and platform standard that makes this work. Because the challenge is bound to the real site, a credential made for one site cannot be replayed against another, which is what stops credential stuffing.
Why is a passkey better than a one-time code for Indian businesses?
It is better because the failure modes disappear. An SMS code can be intercepted after a SIM swap and can be relayed live. A phishing-resistant prompt can be approved by a distracted user. A password can be reused, sold, or coerced out of a help desk. A passkey cannot be typed into a fake site, cannot be phished by a proxy, and needs no network round trip to a server that holds a shared secret. For a business that lives on WhatsApp, Gmail, an Indian banking app and a cloud console, that removes the four most common account-takeover routes in one change.
What do you need to roll out passkeys for a small team?
Less than most people expect. Start with the identity provider, because a passkey registered there protects every application that uses single sign-on. Then protect email, banking and remote access, in that order. Give people a choice of where the passkey lives: the device they already carry, a synced vault for people with two phones, and a hardware key for administrators and finance staff who approve payments. Publish a short recovery rule: a lost device is replaced with a new passkey from an existing one, or from a backup key, and never by a phone call to support. Record passkey registration and removal in your logs, because a passkey added silently to an account is a sign of trouble.
What can go wrong, and how do you prepare for it?
Four things, and all four are manageable. Device loss is the common one, so keep a second passkey on a separate device and one hardware key offline. Platform change is next, because moving from Android to iOS or replacing a laptop can strand a passkey; a synced vault solves this if you allow it, so decide the policy before rollout. Unfamiliar prompts cause support load, so brief the team on what a legitimate prompt looks like and what to do when one appears without their action. And a lost device with no synced vault means recovery through the account recovery path, which must not be a phone call.
| Method | What the attacker must get | Phishing resistant | User effort |
|---|---|---|---|
| Password only | One reused secret | No | Low, but repeated |
| Password plus SMS OTP | The password and the SIM | No | Medium |
| Password plus authenticator app | The password and the seeded app | Partly | Medium |
| Passkey on a device | The unlocked device and a biometric | Yes | Low |
| Passkey plus hardware key | Two separate physical devices | Yes | Medium, admin only |
What are the frequently asked questions?
Get a straight answer on this
Send us the systems your team logs into daily, and we will return a fixed-price passkey and MFA rollout plan with the recovery rules written out.
Send us the details See pricing