The Death of Passwords is Finally Here

We have been promised the death of passwords for a decade. Biometrics were going to replace them. Then hardware tokens. Then SMS codes. None of it killed the password. But passkeys — built on the FIDO2/WebAuthn standard with native support from Apple, Google, and Microsoft — are different. The tipping point has genuinely arrived.

What Is a Passkey?

A passkey is a discoverable FIDO2 credential — a public/private key pair tied to a specific site and user account. The private key lives on your device (in the Secure Enclave on Apple, in the TPM on Windows) and never leaves. The public key is stored on the server. When you authenticate, the server sends a cryptographic challenge your device signs with the private key.

The WebAuthn Ceremony

The authentication flow happens in three steps between the browser, relying party (the website), and authenticator (your device):

1. Browser requests authentication from the relying party, receives a challenge (random bytes) and the allowed credential IDs
2. Browser passes the challenge to the authenticator (platform authenticator via biometric or PIN)
3. Authenticator signs the challenge with the credential's private key, browser sends the signature back to the relying party for verification

Services That Support Passkeys in 2025