The password is dying at the speed of habit
Passkeys work, ship everywhere, and still meet the strongest force in software: what users already do.
By The Signal · · 2 min read
The technology to end passwords exists, ships on essentially every new phone and browser, and is genuinely better against the attacks that matter. Adoption is nonetheless measured in years, because the password's true defence was never security. It was familiarity.
What actually happened
Passkeys — cryptographic credentials stored on your device and unlocked by the same biometric that opens it — moved from standard to default option across major platforms. The large consumer sites report meaningful passkey sign-in shares now; the long tail of the web has barely started.
Who pays, who gains
Phishing is the attack passkeys structurally kill: there is no secret to type into a fake page, because the credential only answers to the real domain. That erases the most common breach class outright — a gain for users and for every service that pays for fraud. The cost sits in edge cases: shared accounts, device loss, the relative who signs in on a borrowed laptop. Recovery flows, not cryptography, decide who gets locked out.
How it actually works
A passkey is a key pair: the private half never leaves your device's secure enclave; the public half sits with the service. Sign-in is a challenge signed locally — nothing reusable crosses the wire. Sync services back the keys up within each platform's cloud, which is where convenience quietly reintroduces a dependency: your keys live where your ecosystem lives.
What happens next
Password managers and cross-platform sync are dissolving the lock-in edge; regulators nudge banks and public services toward phishing-resistant sign-in. The password will linger as the fallback — and the fallback is the attack surface. The constraint nobody mentions: you are done not when passkeys arrive, but when the "or use your password" link leaves.