Why sign-in matters so much
Almost everything you do online sits behind a sign-in. Your email account is often the most important one, because it is where reset links for other accounts are sent. If someone takes over your email, they can often take over much more. Sign-in habits are therefore one of the most useful places to spend a little effort.
For decades the main tool has been the password: a secret you type to prove who you are. Passwords have real weaknesses. People pick ones that are easy to guess, reuse them across sites, and type them into fake pages that look genuine. A newer option, the passkey, was designed to fix several of those problems.
What a password is, and where it goes wrong
A password is a shared secret. You know it, and the website stores a protected form of it so it can check what you type. The trouble is that the secret travels. You type it, it is sent to the site, and anyone who tricks you into typing it somewhere else gets a working copy.
Common failure points include:
- Short or predictable choices that can be guessed quickly.
- The same password used on many sites, so one leak opens several doors.
- Fake sign-in pages, often reached through phishing messages.
- Sites that store passwords poorly and later suffer a leak.
None of this means passwords are useless. A long, unique password stored in an entry in a password manager is still a reasonable protection for most accounts, especially when paired with a second step.
What a passkey is
A passkey replaces the typed secret with a pair of cryptographic keys. One half, the public key, is stored by the website. The other half, the private key, stays on your device and is never sent anywhere. When you sign in, the site sends a challenge, and your device answers it after you approve with your fingerprint, face scan, or device PIN. The site can verify the answer using the public key.
Two things follow from this design. First, there is no shared secret for the website to leak. A stolen copy of the public key is of little use to an attacker. Second, a passkey is tied to the real website address, so it generally will not work on a lookalike page. That makes it resistant to the fake-page trick that catches many careful people.
The fingerprint or face scan is usually just the way you unlock the private key on your own device. It is typically not sent to the website.
Where passkeys live
Passkeys are stored in a credential manager, which might be built into your phone or computer, or provided by a password manager. Many of these can sync passkeys between your devices, so a new phone does not leave you locked out. Others keep a passkey on one device only. How this works varies by provider, and the screens change, so check what your own setup does before relying on it.
The important question is recovery. If your only device is lost and nothing is synced, you will need another way back in. Having recovery options setup in advance, such as a backup email address or saved recovery codes, makes this far less stressful. If the worst happens, lost phone recovery is much easier when you have prepared.
Passkeys or passwords: a practical way to choose
Neither option is right everywhere. A sensible rule of thumb:
| Situation | Reasonable choice |
|---|---|
| The site offers passkeys and you use a personal device you control | Passkey |
| The site offers only passwords | Long, unique password from a manager, plus a second step |
| A shared or public computer | Avoid saving anything; see public computer safety |
| An account several family members must use | Think carefully before choosing; see shared account access |
Passkey support is still uneven. Some sites offer them as a full replacement, others as an addition to a password, and some not at all. It is common to have a mix for a long time, so building good password habits remains worthwhile.
A second step still helps
Where a site does not offer passkeys, a second proof of identity is the next best protection. The various verification code options differ in strength, and an authenticator app or physical security key generally holds up better than a text message. If you are new to the idea, two-step sign-in is a good place to start. If a text message is your only choice, it is still usually better than nothing, though SIM swap fraud is one reason it is considered weaker.
A gentle order of operations
You do not have to change everything at once. A manageable sequence looks like this:
- Secure your main email account first. Give it a long, unique password or passkey, and turn on a second step.
- Do the same for money-related accounts, such as banking and payment services.
- Move on to social media, shopping and anything that stores personal details.
- Add passkeys wherever a site offers them and you are comfortable.
- Keep recovery options current: a spare email address, a phone number you control, and saved backup codes in a safe place.
For many people, a password manager makes steps one to three much easier, because it creates and remembers the long, unique passwords for you.
What to do if something goes wrong
Even careful people sometimes get caught. If a sign-in alert you did not trigger arrives, or friends report strange messages from you, look at the account takeover signs and then follow the steps for hacked account response. Changing the password, signing out other sessions, and checking recovery details are usually the first moves. If a money account is involved, contact the provider promptly.
Keeping expectations realistic
No single method makes an account unbreakable. Passkeys reduce some of the most common risks, but they do not protect a device that is already infected, and they do not help if you hand over access in some other way, such as a phone call from a fake support agent. Staying alert to online scams is still part of the picture.
The aim is not perfection. It is making your accounts harder to take over than the next person’s, and making recovery easier if something does happen. A password manager, a second step, and passkeys where offered together cover the large majority of everyday risk, and each can be adopted one account at a time.