Several large retailers began switching their default login to passkeys this year, part of a slow migration away from passwords that has been promised for a decade. The change is visible at the checkout, where a fingerprint or face scan can now replace a typed password and a one-time code.
Passkeys are not magic. They are a pair of cryptographic keys: one held on your device, one held by the service. The private key never leaves the device, which removes the most common attack, a stolen password reused across sites.
How the login actually works
When you create a passkey, your device generates a key pair and sends the public half to the service. At login, the service sends a challenge, the device signs it with the private key, and the service checks the signature. There is no shared secret to phish.
The device protects the private key with the same lock you use to unlock it. That could be a fingerprint, a face scan or a PIN. The service never sees the biometric data, only the signed response.
The recovery problem
Losing a phone is the obvious worry, and the answer is usually a synced keychain or a backup device. That works well inside one ecosystem and less well across platforms. A household with mixed devices can end up with a passkey that exists in one place only.
Recovery is where the security model bends. If a service lets you reset with an email link, an attacker who controls the email account can bypass the passkey entirely. If it refuses to offer a reset, a lost device can lock a customer out for good.
A login is only as strong as its recovery path. The front door can be unbreakable while the back window stays open.
What retailers gain
Retailers gain fewer account takeovers and fewer abandoned checkouts caused by forgotten passwords. They also gain a cleaner signal that the person paying is the person who owns the account, which matters for fraud rules.
The gain is not automatic. A poorly implemented passkey flow can confuse customers and push them to guest checkout, which solves nothing. The successful rollouts keep the old method visible for a transition period and explain the change at the point of use.
Key facts
- Passkeys use a device-held private key and a service-held public key.
- There is no shared password for an attacker to phish.
- Recovery still depends on email, a backup device or a support desk.
- Mixed-device households are the hardest case.
- Retailers report fewer account takeovers where passkeys are default.
Where passwords remain
Passwords will stay for shared devices, older hardware and services that have not rebuilt their login systems. The realistic future is a mix: passkeys where the device supports them, passwords plus a second factor elsewhere.
That makes the second factor more important, not less. A passkey on one account does not protect another account that still relies on a reused password. The weakest login in the set still sets the level of exposure.
The bottom line
Passkeys are a genuine improvement and a partial one. They close the phishing door on the accounts that adopt them. They do not fix recovery, and they do not cover every service. Use them where offered, keep a backup device, and do not abandon the password manager yet.
