For a business, passkeys are stronger than passwords because they use a key pair, leave no shared secret on the server, and resist phishing. Roll them out first to admins and cloud consoles, keep passwords with MFA as fallback, and use device-bound keys where assurance matters most. Sources are fetched as of 19 October 2026.
Key takeaways
- A passkey is a FIDO credential stored on a phone, computer or security key and unlocked with a biometric, PIN or pattern.
- Phishing resistance is a core design goal of FIDO authentication, so a fake site cannot collect a usable credential.
- Synced passkeys are convenient. Device-bound passkeys offer the highest assurance, per FIDO Alliance.
- NIST SP 800-63B-4 bars syncable authenticators at AAL3 and requires password length of at least 15 characters when a password is the only factor.
What is the difference between a passkey and a password?
A password is a shared secret: you and the server both know it. A passkey uses a public and private key pair. The FIDO Alliance says there are no shared secrets and no passwords to steal, so a breach of a password database does not threaten passkeys.
Are passkeys really phishing resistant?
Yes, by design. NIST SP 800-63B-4 says phishing resistance requires cryptographic authentication and gives WebAuthn and FIDO2 as an example of verifier name binding. Manually entered codes, including one time codes sent to a phone, do not qualify.
Synced or device-bound passkeys: which should a business use?
Use synced passkeys for general staff and device-bound keys for admins and high-risk roles.
FIDO says synced passkeys live with a cloud-backed provider and are end to end encrypted, which fixes the first sign-in problem on a new device. Device-bound passkeys never leave one device, and FIDO says they offer the highest security assurance. The trade-off is that a new device may fall back to weaker methods. NIST's AAL3 requires a non-exportable private key and does not allow syncable authenticators.
| Question | Synced passkey | Device-bound passkey |
|---|---|---|
| Where it lives | Cloud-backed provider, across devices | One device or security key |
| Recovery | Easier | Needs a second key or fallback |
| Assurance (per FIDO) | Strong | Highest |
| NIST AAL3 | Not allowed | Possible with a non-exportable key |
| Best for | Everyday staff | Admins, regulated roles |
What if we still use passwords?
Follow NIST's current rules. A password used alone must be at least 15 characters, and one used only inside multi-factor authentication can be 8. Verifiers should allow at least 64 characters, must not impose composition rules, must not force periodic changes without cause, and should check passwords against a blocklist.
How do I roll out passkeys?
- Enable passkey or security key sign-in in your identity provider. In Google Workspace, passkeys are available when an admin enables skipping the password.
- Start with admins and the cloud console. AWS recommends phishing-resistant MFA such as passkeys and security keys wherever possible.
- Register two credentials per person.
- Keep a break-glass account with a security key in a safe.
- Turn off weak fallbacks like SMS once adoption is high.
See our SSO and MFA guide for provider choices.
Frequently asked questions
Do passkeys replace MFA?
Often, but it depends on the provider and the framework. NIST's definition of multi-factor cryptographic authentication is the place to check, and your auditor's wording decides what counts for your report.
What if an employee loses their phone?
With synced passkeys the credential is available on their other devices. With device-bound keys you need a second registered key, so register two.
Are synced passkeys safe enough?
FIDO says syncing is end to end encrypted, but also notes that passkeys backed by passwords or synced across devices are vulnerable to theft. Use device-bound keys for your most sensitive roles.
Can we drop passwords entirely?
Eventually, for apps that support passkeys. Until then, long unique passwords plus MFA remain the fallback.
Sources
- FIDO Alliance, passkeys
- NIST SP 800-63B-4
- Google Workspace, 2-Step Verification
- AWS IAM security best practices
Last reviewed: 19 October 2026.
