Passwords Are Being Retired, and the Replacement Lives on the Device

For thirty years the password has been the thing everyone agrees is broken and nobody could replace. It is reused, guessed, phished, leaked in breaches by the billion, and propped up by a second factor that adds friction without closing the underlying hole. The replacement now reaching ordinary users is the passkey, and its defining property is that there is no shared secret to steal. A pair of cryptographic keys is created when you enrol; the private half stays in the secure hardware of your device and is released only when you unlock it with a fingerprint, a face or a device PIN; the service only ever holds the public half, which is useless to a thief. Two things follow from that design, and both matter. First, there is nothing to type, so there is nothing to phish. A passkey is bound to the exact website it was created for, which means a lookalike page cannot coax it out of you the way it can coax a password — the single most common way accounts are actually taken over simply stops working. Second, a breach of the service no longer hands attackers a list of credentials to try elsewhere, because the public keys it stores cannot be replayed. The category of harm that follows every large password leak is designed out rather than mitigated. Adoption has crossed from demonstration to default. The major device platforms sync passkeys across a user's own hardware so a login created on a phone works on a laptop, and a growing list of consumer services — email, retail, banking, social — now offer passkey sign-in and, increasingly, suggest it first. For a business running a consumer login, offering passkeys is no longer exotic; the libraries and platform hooks are mature, and the security team's usual objections have already been answered by the standard. The awkward part, and the reason the password is not gone, is recovery and portability. If the account can still fall back to a password or a texted code when the device is lost, the phishing-resistant front door has a weaker side door, and attackers go to the side door. Moving passkeys between different ecosystems is still rougher than moving them within one, and shared or kiosk devices complicate the biometric assumption. The organisations getting the most from passkeys are the ones treating recovery as the real design problem — hardware keys as backup, multi-device enrolment, and a deliberately hardened reset path — rather than bolting passwordless onto a recovery flow that still trusts a password.