For fifty years, the password has been the weakest link in digital life: easy to guess, simple to steal and almost impossible to remember in its dozens of variations. That era is now visibly ending. Passkeys — sign-in credentials stored on your phone or laptop and unlocked with a fingerprint, a face scan or a PIN — have moved from an enthusiast experiment to the default option offered by the world’s largest platforms.
The change is easy to miss because it arrives one login screen at a time. Banks, retailers, airlines and social networks now prompt users to create a passkey when they sign in, and many report that most new accounts choose it. Coverage of the shift on our homepage has tracked the rollout as it spread from early adopters to mainstream services that millions of people use every day without thinking about security at all.
Unlike a password, a passkey cannot be typed into a fake website, read aloud to a scammer or reused across a breached database. It is a pair of cryptographic keys: one public, held by the service, and one private, held only on your device. That design, standardised by the FIDO Alliance and the W3C, is why security agencies now recommend passkeys wherever they are offered.
How a Passkey Actually Works
When you create a passkey, your device generates the key pair and sends only the public half to the website. To sign in later, the site issues a one-time challenge and your device signs it with the private key after you confirm your identity biometrically. Guidance from the National Institute of Standards and Technology treats this kind of phishing-resistant authentication as the strongest widely available option for ordinary users.
Because the private key never leaves your device in usable form, there is no shared secret for criminals to steal from a company’s servers. A breached database yields only public keys, which are worthless on their own. Passkeys also sync through your platform account — Apple, Google or Microsoft — so a new phone can restore them, removing the old fear that losing a device meant losing access to everything.
Why Platforms Are Pushing So Hard
The commercial motive is as strong as the security one. Forgotten passwords are a leading cause of abandoned checkouts and support calls, and every reset flow is an opportunity for account takeover. Services that have published figures report faster sign-ins and fewer lockouts after introducing passkeys. Our technology coverage has noted the same pattern across retailers and banks alike: convenience, not fear, is what finally moves ordinary users to better security.
Regulators are adding pressure from the other direction. Financial and public-sector rules increasingly expect multi-factor authentication that resists phishing, and typed one-time codes sent by text message are falling out of favour. Passkeys satisfy those expectations in a single step, which makes them attractive to compliance teams as well as to product designers trying to remove friction from sign-up screens.
What Still Needs to Improve
The transition is not finished. Account recovery remains the soft underbelly: if a service lets you regain access with a weak password or an emailed link, attackers will simply use that door instead. Cross-platform use can still feel clunky when a passkey lives in one ecosystem and you are signing in from another, although QR-code sign-in between devices has eased that problem considerably.
Reporting by the BBC’s technology desk has highlighted the remaining confusion among users who do not realise a passkey has been created for them at all. The sensible advice is simple: accept the offer when a trusted service suggests a passkey, keep your device lock strong, and treat recovery options with the same care as the sign-in itself. The password will linger in corners for years, but its reign is over.
