{"id":29872,"date":"2025-06-06T13:27:25","date_gmt":"2025-06-06T13:27:25","guid":{"rendered":"https:\/\/blog.lacnic.net\/?p=29872"},"modified":"2025-06-25T15:00:02","modified_gmt":"2025-06-25T15:00:02","slug":"passwords-passkeys","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/passwords-passkeys\/","title":{"rendered":"No More Passwords: Meet Passkeys"},"content":{"rendered":"\n

By Guillermo Pereyra<\/a>, Security Analyst<\/p>\n\n\n\n

Traditional passwords are no longer enough to protect our accounts. Every day we see data breaches, phishing attacks, and credential theft through malware. Even when using two-step authentication, users can fall for traps by entering their credentials on fake sites.<\/p>\n\n\n\n

That\u2019s where passkeys come in\u2014a new cryptography-based standard offering much stronger protection. In this article, we will look at how they work from a user\u2019s point of view and why they might mark the beginning of a password-free future.<\/p>\n\n\n\n

<\/a>What Are Passkeys?<\/strong><\/strong><\/h2>\n\n\n\n

Passkeys are based on public and private key cryptography. When you create a passkey for a website, a pair of cryptographic keys is generated: a private key that stays encrypted on your device (like your phone or computer), and a public key that is stored on the website\u2019s server.<\/p>\n\n\n\n

The following table shows some differences between passkeys and traditional passwords:<\/p>\n\n\n\n

Feature<\/strong><\/td>Passkeys<\/strong><\/td>Passwords<\/strong><\/td><\/tr>
Storage<\/td>Private key on user\u2019s device<\/td>On server (with hash)<\/td><\/tr>
Creation<\/td>Automatically generated       <\/td>Created by the user<\/td><\/tr>
Security<\/td>Very high (phishing, brute force, leaks, etc.)<\/td>Depends on complexity, 2FA use, and server-side protections<\/td><\/tr>
Ease of use<\/td>High<\/td>Depends on complexity<\/td><\/tr>
Theft protection<\/td>High<\/td>Low<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

<\/p>\n\n\n\n

<\/a>How Passkeys Work<\/strong><\/strong><\/h2>\n\n\n\n

<\/a>Creating a Passkey<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Setting up a passkey is quick and typically located in your account\u2019s password settings. The name varies by platform\u2014for instance, Google calls them \u201caccess keys\u201d and Microsoft refers to them as \u201cpasskeys.\u201d<\/p>\n\n\n\n

After locating the option, the passkey is generated, and you choose where to store the private key: browser, password manager, or mobile device.<\/p>\n\n\n\n

If the same password manager is used across multiple devices, the private key will sync automatically, allowing site access from any of them.<\/p>\n\n\n\n

Here is an example of adding a Passkey in Google, saved to a mobile phone:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

During this process, the key pair is created: the private key remains on the client side and the public key is saved on the server.<\/p>\n\n\n\n

<\/a>Accessing a Website Using a Passkey  <\/h2>\n\n\n\n
    \n
  1. Find the Passkey option<\/strong> on the website:<\/li>\n\n\n\n
  2. It may appear as \u201cPasskey\u201d or \u201cAccess key,\u201d depending on the translation.<\/li>\n\n\n\n
  3. Some sites offer it directly; others must be selected manually.<\/li>\n<\/ol>\n\n\n\n
      \n
    1. Enter your username.<\/strong><\/li>\n\n\n\n
    2. Choose where your private key is stored:
      <\/strong>It may be on your phone, computer, a security key, or the cloud.<\/li>\n\n\n\n
    3. Confirm your identity using your device\u2019s unlock method:<\/strong><\/li>\n\n\n\n
    4. Fingerprint<\/li>\n\n\n\n
    5. Facial recognition<\/li>\n\n\n\n
    6. PIN or other configured method<\/li>\n<\/ol>\n\n\n\n

      Ready.<\/strong> You will access the site without typing or sharing a password.<\/p>\n\n\n\n

      Examples of logins using Passkeys on Amazon and Google:<\/p>\n\n\n\n

      \n
      \n
      \"\"<\/figure>\n<\/div>\n\n\n\n
      \n
      \"\"<\/figure>\n<\/div>\n<\/div>\n\n\n\n

      It is important to configure multiple Passkeys for the same website, especially if you use different devices or separate password managers.  This prevents losing access if the device storing your private key is unavailable. Having multiple Passkeys is recommended.
      <\/strong><\/p>\n\n\n\n

      Characteristics of Passkeys<\/strong><\/strong><\/h2>\n\n\n\n
      \"\"<\/figure>\n\n\n\n

      Unlike traditional passwords, they are based on public-key cryptography.  This makes them resistant to:<\/p>\n\n\n\n