Passwords are still the most common weak spot in the office. They get reused, written on notes or typed into fake login pages. Multi-factor authentication has improved things considerably, but codes sent by SMS or app can also be captured through well-made phishing pages. Passkeys close that gap.
What a passkey is
A passkey is a cryptographic key pair. The private key stays on the device, such as a laptop, a smartphone or a security key like a YubiKey. The service only knows the public key. When you sign in, you confirm with your fingerprint, face recognition or a PIN, and the device proves to the service that it holds the matching key.
The passkey is bound to the real address of the service. It therefore doesn’t work on a fake page, and staff can’t give it away by mistake. The service itself stores no password that could be stolen in a data breach.
Faster, with fewer support tickets
The FIDO Alliance, the body behind the standard, analysed data from nine large providers in 2025. Passkey sign-ins succeeded in 93 percent of cases, compared with 63 percent for other methods such as SMS codes or email links. A sign-in took 8.5 seconds on average instead of 31.2, and sign-in related support requests fell by 81 percent.
Synced or device-bound
Passkeys come in two forms:
- Synced passkeys are shared across several devices through a password manager or the Apple, Google or Microsoft keychain. If the smartphone is lost, the passkey is available again on the new device.
- Device-bound passkeys never leave the device, for example on a security key or in the Microsoft Authenticator app. They are the safer choice for administrators and for accounts with access to finances.
For most staff, a synced passkey is enough. For admin accounts, we recommend security keys.
Passkeys in Microsoft 365
Microsoft Entra ID, the user directory behind Microsoft 365, has supported passkeys for some time. Since 2026 it offers passkey profiles, which let you define per user group which type of passkey is allowed. Synced passkeys are now officially supported as well. For an SME, that means accounting can sign in with security keys and the rest of the team with their smartphones.
Google and Apple accounts and many online services also offer passkeys. Common password managers can store passkeys and sync them to all devices.
Passkeys with open-source tools
Passkeys are based on the open FIDO2/WebAuthn standard and also work without Apple, Google or Microsoft:
- Bitwarden and Vaultwarden store passkeys in the vault and sync them to all devices. With Vaultwarden, the server runs on your own premises or with a Swiss hosting provider.
- KeePassXC has stored passkeys in its local database since version 2.7.7, with no cloud involved.
- Keycloak has officially supported passkeys since version 26.4. This lets you protect your own applications, intranet and business portals with passkeys through single sign-on.
- Nitrokey makes security keys with open-source firmware, an alternative to the YubiKey.
For companies that don’t want to keep their credentials with a US corporation, Vaultwarden with the Bitwarden apps is a good starting point. Background in our article on digital sovereignty.
Introducing passkeys step by step
- Take stock. Which services do you use, and which of them support passkeys? Microsoft 365 or Google Workspace is usually the first step.
- Start with the admins. Administrator accounts get a device-bound passkey first, ideally on two security keys, with one kept as a spare in a safe.
- Bring the team on board. A short guide and ten minutes at each workstation are usually enough for the setup.
- Plan for recovery. What happens if someone loses their smartphone and laptop at the same time? A clear procedure with identity checks stops attackers from getting new access through the help desk.
- Switch off old methods. Once everyone has moved over, disable SMS codes and other weak methods.
Passwords won’t disappear overnight. Older business applications and some web portals don’t support passkeys. For those, a password manager and multi-factor authentication remain the right solution.
Rolling out passkeys with A BOT
We check which of your services support passkeys, set up the policies in Microsoft 365, supply suitable security keys and support your team through the switch. More under IT security and workplace.
Frequently asked questions
What happens if a smartphone is lost?
Synced passkeys become available again on a new device through the Apple or Google account or the password manager. Device-bound passkeys need a second key or a defined recovery procedure.
Does the service store my fingerprint?
No. Fingerprint and face are checked only locally on the device and never leave it. The service just receives confirmation that the key was unlocked.
Do we need new hardware?
Usually not. Current laptops with Windows Hello or Touch ID and common smartphones are enough. Security keys are mainly needed for administrators.
Are passkeys safer than a password with multi-factor authentication?
Yes, especially against phishing. Codes from SMS or an app can be intercepted on a fake page, while a passkey simply doesn’t work there.
