The Password-less Future is Closer Than You Think

How many times a day do you, your employees, and your customers login to the websites and mobile apps you rely on? For those of us working in technology or tech-adjacent industries it’s several dozen times a day, especially when you include lower- friction methods like passwords saved by your browser or biometric authentication. Even for the average user, daily reliance on apps means that we are likely passing insecure authentication credentials far too often.

A 2022 NordPass study found that the average person today has 100 passwords. Having to regularly come up with new passwords, or more likely, using or riffing off existing passwords, is both a headache and an opportunity for a bad actor trying to access that person’s data. Even with the prevalence of password managers, multifactor authentication (MFA), and other authentication measures, customer data and organization security are still highly vulnerable to phishing attacks and data breaches that often expose large sets of customer usernames and passwords.

Imagine a future in which logging in to all of your accounts is as simple as using biometric authentication to unlock your phone. Enter passkeys. Passkeys are a password-less alternative to authenticating based on a common standard developed by the FIDO Alliance and the World Wide Web Consortium (W3C) and supported by major tech companies such as Apple, Google, and Microsoft.

At a technical level, a passkey is a cryptographic entity that’s not readable by you, and it’s used in place of a password. A passkey consists of a key pair; one key is public, registered with the website or app you’re using, and the other key is private, held only by your device. There is nothing about a passkey that you must create, guard, or remember. Passkeys offer the rare one-two punch of both a better user experience and enhanced security. 

The first flow shown below is one with which every user and organization with a presence online is familiar and has come to accept as a requirement to keep data safe. Organizations have pushed features such as Two Factor Authentication (2FA) and MFA onto users in the name of enhanced security; however, these flows add friction to the user experience and can impact conversion rates and user frustration.

In comparison, as shown in the second flow, the login process with passkeys is much more streamlined, removing the need to type, remember, or store passwords. Furthermore, common 2FA and MFA flows are no longer necessary due to the heightened security that passkeys enable.