Why passkeys matter (even if you already have a password)
Most inventory logins still start the same way they did twenty years ago: an email and a password. That is a shared secret. You type it, the site checks it, and anyone who learns it can pretend to be you. Phishing pages, reused logins from other breaches, and infostealer malware all work because the secret can leave your head and travel over the network.
Verizon’s 2026 Data Breach Investigations Report still finds the use of stolen credentials in about 36% of breaches. Credentials themselves show up as stolen data in more than a quarter of them. The “human element” (phishing, mistakes, social engineering) is in roughly three out of five breaches. Passwords are not the only way in, but they remain a reliable one.
What a passkey actually is
A passkey is a FIDO2 / WebAuthn credential: a public/private key pair created on your device (or in a password manager or hardware security key) for one specific website. The site stores the public key. The private key never leaves the authenticator. When you sign in, the site sends a one-time challenge. Your device unlocks the private key the same way you unlock the phone or laptop (Windows Hello, Face ID, a PIN, a security-key touch) and signs the challenge. The site checks the signature. Done.
There is no password to remember, reuse, or paste. There is also no secret sitting in our database that is useful if someone copies it. A dumped public key cannot log anyone in.
The FIDO Alliance treats “passkey” as a common noun, like “password.” Synced passkeys travel with your Apple, Google, or manager account. Device-bound passkeys (including FIDO security keys) stay on one authenticator. Both are passkeys. The synced kind is how most people will use them day to day. The device-bound kind is the stricter option when you want the private key never to leave a piece of hardware.
Why phishing bounces off
The important property is not the biometric. It is origin binding. When the passkey is
created, the browser records the real site (the relying-party ID, basically the domain). At sign-in the
authenticator will only use that passkey if the request comes from that same domain. A lookalike at
simpleinventorymanagement.example cannot exercise a passkey registered for
simpleinventorymanagement.com. The device refuses. You do not get a chance to “confirm”
on the fake page.
That is what “phishing-resistant” means in CISA and NIST language: the authenticator will not hand a usable secret to a site impersonating yours. The UK National Cyber Security Centre compared FIDO2 credentials with passwords and with traditional MFA (password plus SMS, app code, or push). Against adversary-in-the-middle phishing, traditional MFA is still vulnerable. FIDO2 is not. SMS codes and “approve this login” prompts can be relayed in real time. A passkey cannot, because the signature is bound to the real origin.
NIST’s Digital Identity Guidelines (SP 800-63B-4) now require services at assurance level 2 to offer a phishing-resistant option, and they require phishing resistance at level 3. CISA calls FIDO/WebAuthn (security keys and passkeys) and PKI smart cards the methods that actually qualify. Push notifications, email codes, and SMS do not.
Stuffing, dumps, and “I used a unique password”
Even a unique, long password fails if it is typed into the wrong site, or if malware on the laptop reads it as you type. Credential stuffing works because people reuse passwords across sites; a leak elsewhere becomes a login here. Infostealer logs in recent Verizon reporting keep showing corporate emails mixed with personal ones on unmanaged devices. None of those attacks produce a private key they can use on our domain.
A FIDO Alliance consumer survey for World Passkey Day 2025 found 36% of people had at least one account compromised because of passwords. That is not a reason to panic. It is a reason to stop making the login secret something a person can be tricked into typing.
What this is not
- Not magic against a fully owned laptop. If malware already runs as you, it can abuse whatever you can unlock, including some synced passkey stores. Passkeys raise the bar for remote phishing. They do not replace device hygiene.
- Not a reason to drop SSO. If your company requires SAML, that still wins. Passkeys are for accounts that sign in directly here. They do not bypass require-SSO on a verified domain.
- Not a second factor on top of the password. A passkey is a primary sign-in. Keep the authenticator-app 2FA we already support if you want a second step on password login. Do not treat a passkey as that second step.
- Not unrecoverable. Keep a password (and, for a company, SSO) so a lost phone is inconvenient, not a lockout. Register more than one passkey if you can: laptop plus phone, or a hardware key as backup.
Where passkeys fit next to SSO
SAML single sign-on is still the right move when a company already lives in Okta, Entra ID, or Google Workspace. The IdP becomes the front door: offboarding is one switch, and MFA policy lives in one place. Passkeys help everyone else, and they help the owner who is not behind an IdP yet: the person who would otherwise reuse a password on the inventory app that holds supplier costs, stock positions, and order history.
Inventory is operational data. A stolen login is not only “someone saw a count.” It is someone who can adjust stock, complete orders, or quietly read what you buy and what you pay. Making that login phishing-resistant is the same instinct as locking the stockroom. The difference is the fake stockroom on the internet cannot pick the lock.
How to start
- Sign in as usual, then open Passkeys in account settings.
- Add a passkey on the device you actually use. Give it a name you will recognize later.
- Add a second one if you can (phone and laptop, or a hardware key).
- Next visit, use “Sign in with a passkey,” or let the browser offer one in the email field.
You still have your password. This is an extra door, not a demolition of the old one. For the rest of how we protect accounts and AI connections, see the security page.