Passkeys: The End of Passwords?

A password can be guessed, replayed, or stolen through phishing. A passkey is a pair of cryptographic keys: the secret half never leaves your device, and nothing usable is ever sent to the site. There is simply nothing left to phish.

It's the same philosophy as ZAIA on the client side: never hand over anything secret.

01 — How it works

A key that stays on the device

At creation, the device generates a key pair for that site: the private key stays protected locally, the public key goes to the site. At sign-in, the device proves it holds the private key, unlocked by fingerprint, face, or device passcode.

02 — Why it's better

Phishing stops working

• Nothing reusable is ever transmitted: no secret to intercept.
• The passkey is tied to the legitimate domain: a fake site cannot use it.
• No password to remember, reuse, or have leaked in a data breach.

03 — Today's limitations

What isn't quite seamless yet

• Syncing across devices depends on the ecosystem (Apple account, Google, third-party manager).
• Sharing one account among several people: designed for an individual, not a team.
• A fallback method is essential in case all devices are lost.

04 — Offering them on a website

Alongside existing methods, gradually

Build on the WebAuthn standard, offer the passkey as an option alongside existing methods, plan a safe recovery path, and communicate simply ("sign in with your fingerprint").

05 — Frequently asked questions

Frequently Asked Questions

Do passkeys really replace passwords?

Gradually. During the transition, sites offer both. The long-term goal is to do away with passwords entirely.

What happens if I lose my phone?

If your passkeys are synced to your ecosystem account, they come back on a new device. Otherwise, you need a fallback method set up in advance.

Is this suited to shared professional use?

For individual accounts, yes. For accounts shared by a team, management is still imperfect — named individual accounts remain the better option.

06 — Resources & links

Where to go, concretely