A passkey is a sign-in credential that replaces your password with a cryptographic key pair stored on your device or in a secure password vault. You unlock it with your fingerprint, face or device PIN, and it only works on the genuine website it was created for. That one design choice means a passkey cannot be phished, cannot be reused across sites, and cannot be leaked in someone else’s data breach — the three ways most business accounts are actually broken into.
Passkeys are no longer an experiment. The FIDO Alliance, the industry body behind the standard, estimated in its State of Passkeys 2026 report that roughly 5 billion passkeys are now in active use worldwide, that 75% of consumers have enabled one on at least one account, and that 68% of organizations are deploying, piloting or rolling out passkeys for their employees. The question for most small and midsize businesses is no longer whether passkeys work. It is how to get every account and every employee onto them without creating chaos.
This guide explains what passkeys are in plain English, walks through real breaches they would have prevented, and covers the piece most articles skip: how a business password manager with passkey support lets your whole team adopt them, including on the accounts that still need passwords.
Why Passwords Keep Failing
A password is a shared secret. You know it, the website stores a version of it, and anyone else who learns it can use it from anywhere in the world. Every way that secret escapes leads to the same place:
- Reuse. A password used on more than one site is only as safe as the weakest of those sites. When one gets breached, attackers try the same email and password everywhere else — a technique called credential stuffing.
- Phishing. A convincing fake login page collects the password the moment someone types it.
- Infostealer malware. Malicious software quietly harvests every password saved in a browser and sells them on criminal marketplaces, sometimes years before anyone uses them.
- Guessing. Short, predictable or default passwords fall to automated attempts.
The 2025 Verizon Data Breach Investigations Report found that stolen credentials were the single most common way attackers got into organizations, ahead of exploited vulnerabilities and phishing. In breaches against web applications, the overwhelming majority involved stolen credentials. Attackers rarely break in anymore. They log in.
How Passkeys Work, in Plain English
When you create a passkey for an account, your device generates two matching keys. The public key goes to the website. The private key stays with you, locked inside your device or your encrypted password vault, and never leaves. When you sign in, the website sends a one-time challenge, your device signs it with the private key after you confirm with a fingerprint, face scan or PIN, and the website checks the signature against the public key it holds.
Three things follow from that, and they are the whole case for passkeys:
- There is nothing to steal from the website. A public key is useless to an attacker. If the website is breached, your passkey is not exposed.
- There is nothing to reuse. Every passkey is unique to one account on one site. Credential stuffing simply does not apply.
- It refuses to work on a fake site. A passkey is cryptographically bound to the real web address it was created for. If an employee lands on a pixel-perfect copy of your Microsoft sign-in page, the passkey will not respond, because the address is wrong. No judgment call is required from the person at the keyboard.
That third point is what security professionals mean by phishing-resistant authentication, and it is why the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends phishing-resistant multi-factor authentication as the strongest available standard. A passkey is two factors in one: something you have (the device or vault holding the key) and something you are or know (your fingerprint, face or PIN).
Real-World Breaches Passkeys Would Have Stopped
None of the following required sophisticated hacking. Each one came down to a password, or a sign-in method that could be talked out of someone.
Colonial Pipeline (2021): one old password, one unused account
The ransomware attack that shut down the largest fuel pipeline on the U.S. East Coast began with a single password for a legacy remote-access account that was no longer in use but had never been disabled. The company’s CEO told the U.S. Senate that the account did not have multi-factor authentication. The password had appeared in a leak. Attackers did not defeat anything — they signed in. A passkey cannot be leaked that way, because there is no reusable secret to leak.
23andMe (2023): 14,000 reused passwords, 6.9 million people affected
Attackers used email and password combinations stolen from other websites to sign in to about 14,000 accounts at the genetic testing company — customers who had reused passwords and did not have two-step verification turned on. Through features that connected those accounts to relatives, the attackers then reached personal data for roughly 6.9 million people. This is credential stuffing at its most damaging: a small number of reused passwords opening the door to millions of records. Passkeys are unique per site, so stolen passwords from one service cannot be replayed against another.
The 2024 cloud data platform attacks: passwords stolen years earlier
In 2024, a criminal group signed in to the cloud data warehouse accounts of roughly 165 organizations, including major telecom, ticketing and financial companies, and stole enormous volumes of customer data for extortion. Investigators at Mandiant found the platform itself was never breached. The attackers used usernames and passwords harvested by infostealer malware — some stolen as far back as 2020 — against accounts that did not require multi-factor authentication. The lesson for a 20-person business is identical: a password saved in a browser on one infected laptop can sit on a criminal marketplace for years, waiting.
Uber (2022): MFA that could be talked into saying yes
This one matters because the victim did have multi-factor authentication. An attacker obtained a contractor’s password, then flooded the contractor’s phone with sign-in approval requests and messaged them pretending to be IT support until one request was approved. Push approvals, text codes and authenticator codes all share that weakness: a person can be pressured or tricked into handing them over. A passkey cannot be approved remotely for someone else, and it will not sign in to a site the attacker controls.
Adversary-in-the-middle phishing: MFA codes captured in real time
Microsoft has reported large-scale phishing campaigns that targeted more than 10,000 organizations using a relay server placed between the victim and the real Microsoft sign-in page. The victim types their password and MFA code into what looks like Microsoft, the relay passes it through, and the attacker keeps the resulting signed-in session. Text codes and authenticator codes do not stop this. Passkeys do, because the relay’s web address is not the real one and the passkey will not answer it. Our guide to spotting phishing walks through this attack in detail.
Passkeys vs. Passwords vs. Traditional MFA
| Threat | Password only | Password + text or app code | Passkey |
|---|---|---|---|
| Reused password from another breach | Vulnerable | Mostly protected | Protected |
| Fake login page | Vulnerable | Vulnerable (code can be captured) | Protected |
| Adversary-in-the-middle relay | Vulnerable | Vulnerable | Protected |
| MFA fatigue / push bombing | Not applicable | Vulnerable (push approvals) | Protected |
| Website breach exposing credentials | Vulnerable | Password exposed | Nothing usable exposed |
| Infostealer harvesting saved passwords | Vulnerable | Password exposed | No password to harvest |
| Speed of signing in | Typing | Typing plus a code | One touch or glance |
One honest qualification: passkeys protect the sign-in. They do not protect a session that has already been stolen from an infected computer, and they do not replace endpoint protection, monitoring or good recovery procedures. They close the front door; the rest of a layered security program covers the windows.
Why a Business Password Manager Is the Practical Path to Passkeys
Here is the reality most passkey articles leave out: your business will not be passwordless next month. Your Microsoft 365 tenant, banking portal and major cloud apps may support passkeys today. Your industry software, vendor portals, older line-of-business systems and that one supplier website almost certainly do not. For years, your team will live in a mixed world.
A business-grade password manager with built-in passkey support is the tool that makes that mixed world safe and manageable. The solution North Star deploys for clients is built on a zero-knowledge architecture, meaning every vault is encrypted on the user’s own device before anything is stored, so neither the provider nor North Star can read your credentials. In practice, it gives a business:
- Passkeys that work on every device. Passkeys stored in the encrypted vault follow the employee across Windows, Mac, iPhone and Android, instead of being locked to one phone or one browser.
- Strong, unique passwords everywhere passkeys aren’t supported yet. The vault generates and fills a different random password for every remaining site, which eliminates reuse — the cause of the 23andMe breach.
- Passwords out of the browser. Credentials move out of browser password stores, the exact place infostealer malware harvests from in attacks like the 2024 cloud data platform breaches.
- Phishing protection built into autofill. The vault only offers to fill credentials on the exact site they belong to. When it stays silent on a login page, that silence is a warning.
- Secure sharing without sticky notes or spreadsheets. Shared accounts — a social media login, a vendor portal, the Wi-Fi admin page — are shared from the vault with specific people, and access can be revoked instantly.
- Clean offboarding. When someone leaves, their access to company credentials ends when their account is disabled, and the business keeps ownership of every shared login. No more guessing which passwords a former employee knew.
- Breach monitoring. The vault flags weak, reused and exposed passwords, and alerts when stored credentials appear in known breach data, so they can be changed before they are used.
- Central policy and audit trail. Administrators can enforce vault security settings, require strong authentication to the vault itself, and produce reports that cyber insurance carriers and auditors increasingly ask for.
A note on the options: passkeys can also be stored on a single device or on a hardware security key. Device-bound keys offer the highest assurance and are the right choice for administrator and finance accounts. For the rest of the team, passkeys held in a well-managed vault offer near-equivalent phishing resistance with far better recovery — a lost phone does not mean a locked-out employee. Most businesses we work with use both.
Why Every Business Should Make the Switch
- It removes the most common way in. Stolen and reused credentials remain the top initial access method in breach research year after year.
- It takes the judgment call off your employees. Training helps, but a passkey simply refuses to work on a fake site, no matter how convinced the person is.
- It is faster, not slower. Signing in with a fingerprint or face is quicker than typing a password and waiting for a code. Organizations deploying passkeys report fewer password reset requests and faster logins.
- Insurers and clients are asking. Cyber insurance applications and client security questionnaires increasingly ask specifically about phishing-resistant authentication and password management, not just whether MFA exists.
- The standards have caught up. Passkeys are built on open FIDO standards supported by Microsoft, Apple and Google, and NIST’s digital identity guidelines now recognize synced passkeys as a strong authenticator.
- It is low cost for the risk removed. Compared with the price of a single account takeover — a redirected wire, a ransomware recovery, a breach notification — a password manager is one of the least expensive controls in a security budget.
How to Roll Out Passkeys Without Disrupting Your Team
- Deploy a business password manager first. Get every employee into a managed vault and import their existing passwords out of browsers and spreadsheets.
- Fix the passwords you already have. Use the vault’s reports to replace reused and weak passwords, starting with email, banking and admin accounts.
- Turn on passkeys where they are supported. Start with Microsoft 365 or your email platform, then financial accounts and major cloud apps. Each new passkey is saved to the vault.
- Protect the highest-risk accounts with hardware keys. Administrators, owners and anyone who can move money get device-bound passkeys or security keys.
- Retire weaker methods. Once passkeys are in place, use conditional access policies in Microsoft 365 to phase out text-message codes and push approvals for sensitive accounts.
- Write down recovery. Decide how a locked-out employee proves who they are and gets back in, so recovery does not become the new weak point.
If your business has not yet put multi-factor authentication in place at all, start with our plain-language explanation of multi-factor authentication — passkeys are the strongest version of the same idea.
Frequently Asked Questions About Passkeys
What is a passkey?
A passkey is a replacement for a password built on public-key cryptography. The website holds a public key, and you hold the matching private key on your device or in an encrypted password vault, unlocked with your fingerprint, face or PIN. Because the passkey only works on the genuine site it was created for, it cannot be phished, reused or stolen from the website.
Are passkeys more secure than passwords with MFA?
Yes. Text codes, authenticator codes and push approvals can all be captured by a fake login page or approved by a pressured employee. A passkey combines two factors and is cryptographically tied to the real website, so it resists phishing, adversary-in-the-middle relays and MFA fatigue attacks that defeat traditional MFA.
What happens if I lose my phone?
If your passkeys are stored in a business password manager, they are synced across your devices and remain available after you sign in to the vault on a new device. That is a key advantage over passkeys locked to a single phone. Businesses should still define a recovery process so a locked-out employee can be verified and restored securely.
Do passkeys work with Microsoft 365?
Yes. Microsoft supports passkeys for work accounts, and they can be combined with conditional access policies to require phishing-resistant sign-in for sensitive users and applications. Configuration varies by license and tenant settings, so it is worth reviewing with your IT provider before rolling out.
Why do we still need a password manager if we use passkeys?
Because most businesses use dozens of applications and only some of them support passkeys today. A business password manager stores passkeys for the sites that support them and strong, unique passwords for the ones that do not, keeps credentials out of browsers where malware harvests them, and lets you share and revoke access centrally when people join or leave.
Is a cloud password manager safe?
A well-designed business password manager uses zero-knowledge encryption, meaning the vault is encrypted on your own device and the provider cannot read its contents. The vault itself should be protected with strong authentication. Used that way, it is far safer than the alternatives most businesses actually use today: reused passwords, browser storage, spreadsheets and sticky notes.
Are passkeys hard for employees to use?
No. For most employees, signing in with a passkey is easier than a password: a fingerprint, face scan or PIN, with nothing to remember or type. The work is in the rollout — choosing which accounts to convert first, setting policies and planning recovery — which is where an IT provider helps.
How We Can Help
North Star deploys and manages business password management with passkey support for organizations across the Denver metro area, Colorado Springs and Fort Collins. We get your team into a managed vault, clean up reused and exposed passwords, turn on passkeys across Microsoft 365 and your other key systems, protect administrator and finance accounts with hardware keys, and set the conditional access policies that retire weaker sign-in methods. It all fits inside our cybersecurity services, alongside Zero Trust access and managed threat protection, as part of complete small business IT support.
Not sure how exposed your current passwords are? Our free cybersecurity risk assessment is a good place to start, or book a conversation with our team below. You can also reach us through our contact page or at 303-552-0018.
