Cybersecurity Month · Week 3
Logging in should be easy. And secure.
Passkeys let you sign in with your fingerprint, face, or device PIN. There’s nothing to type, nothing to steal, and no code to share.
This week, we focus on passkeys.
A passkey lets you sign in using something you already use every day, such as your fingerprint, face recognition, or device PIN. Instead of remembering a password and entering a security code, you simply approve the sign-in on your trusted device.
Why passwords keep failing
Passwords can be:
- Copied
- Guessed
- Reused across sites
- Typed into convincing fake websites
A passkey changes the equation. It leaves an attacker:
- Nothing to type
- Nothing to capture
- No sign-in code to share
7,000
password attacks every second, more than double the 2023 rate, according to Microsoft.
Source: Microsoft Security Blog (May 2025)
Easier to Use, Harder to Steal
With a passkey, signing in can be as simple as unlocking your computer, phone, or tablet.
It’s easier
Less to remember
No more:
- Remembering complex passwords
- Resetting forgotten passwords
- Typing security codes from text messages or authentication apps
It’s more secure
Nothing for a fake site to steal
Cybercriminals use phishing emails and fake websites to steal passwords and MFA codes. Passkeys stop these attacks because:
- Your passkey stays tied to your trusted device
- There is no password to steal
- There is no code to enter
- Fake websites can’t trick you into giving away your sign-in
The payoff: less time signing in, fewer passwords to remember, and stronger protection against the most common attacks.
How Passkeys Work
You don’t need to understand the technology to use a passkey, but the basics show why it’s so hard to phish.
Passkeys are built on an open standard from the FIDO Alliance. They work with Microsoft, Google, and Apple accounts, and with a growing list of other sites and apps.
1
Setting it up
Your device makes a pair of keys
When you create a passkey, your phone or computer makes two matching keys. The private key stays locked on your device. The website keeps only the public key, which is useless to a thief on its own.
2
Signing in
You unlock, your device answers
The site sends a one-time challenge. You confirm with your fingerprint, face, or PIN, and your device answers with its private key. Your fingerprint or face never leaves the device.
3
The catch for scammers
It only works on the real site
Each passkey is tied to the exact website it was made for. A look-alike login page can’t use it, so even a convincing phishing link gets the attacker nothing.
Why Microsoft Is Pushing Passkeys
If it feels like Microsoft keeps nudging you toward passkeys, it is. Passwords and text-message codes have become the easiest way into an account, and Microsoft has been moving people away from both, one step at a time:
1
New accounts skip the password
Brand-new personal Microsoft accounts are passwordless by default. You’re steered to a passkey from the start.
May 2025
2
Authenticator drops passwords
Microsoft Authenticator stopped saving and filling passwords. It still handles passkeys, and saved passwords moved to Microsoft Edge.
Summer 2025
3
Work accounts follow
Microsoft began moving every Microsoft 365 tenant to new passkey settings in Entra ID, including passkeys that sync across your devices.
March 2026
4
Text codes are on the way out
Microsoft is phasing out SMS codes for signing in to personal accounts, calling SMS “a leading source of fraud.” Passkeys and a verified email take their place.
Rolling out now
The reasoning is simple. Passwords get phished, guessed, and reused, and text-message codes can be intercepted or hijacked through SIM swaps. A passkey takes both off the table.
For businesses: If your team signs in to Microsoft 365, passkeys are already available in your tenant. InfraNet can help you roll them out with the right recovery options, so nobody gets locked out.
The Numbers Behind the Push
98%
of passkey sign-ins succeed, compared with about 32% for passwords.
8x
faster to sign in with a passkey than with a password plus multifactor authentication.
36%
of successful sign-ins at major consumer services now use a passkey, up from 26% a year earlier.
Source: FIDO Alliance Passkey Index 2026, via Start With Identity
7 billion
passkeys are estimated to be in use worldwide.
Source: FIDO Alliance Passkey Index 2026, via Start With Identity
Microsoft alone reports nearly a million new passkeys registered every day.
Common Questions
Straight answers
Changing how you sign in raises fair questions. These are the ones we hear most.
Still unsure?
Ask us. We’re happy to walk you or your team through setting up a first passkey.
What if I get a new phone or computer?
Your passkeys can often be synced securely through your device account, which makes moving to a new device easy. Passkeys can also be stored in modern password managers.
What if I forget my password?
With passkeys, you typically won’t need to remember a password for everyday sign-ins.
Is my fingerprint or face stored by the company?
No. Your biometric information stays on your personal device and isn’t shared with websites or organizations.
Can someone use my passkey if they steal my phone?
Not easily. They would still need your device PIN, fingerprint, or face recognition to unlock it.
Passkeys, password managers, and security keys work together. Use a passkey whenever an app supports it. Keep a password manager for accounts that still need passwords, since many can store passkeys too. Administrators, executives, and anyone who needs extra protection can add a physical security key, such as a YubiKey.
Set Up Your First Passkey
Start with an account you use every day. Each one takes a few minutes. For your work Microsoft 365 account, check with your IT team first.
Microsoft account
Outlook, OneDrive, Xbox
Add a passkey to your personal Microsoft account and sign in with your face, fingerprint, or PIN.
Google account
Gmail, YouTube, Android
Create a passkey for your Google Account and sign in the same way you unlock your phone.
Apple devices
iPhone, iPad, Mac
Your iPhone can create and use passkeys for supported sites and apps, and keeps them in the Passwords app.
Copilot Readiness Assessment
Is your Microsoft 365 ready for Copilot?
Copilot works with whatever it can reach in your environment, including the messy parts: overshared files, stale permissions, and sensitive data in the wrong places. Our readiness checklist shows whether your tenant is organized, secure, and mature enough to put AI to work safely.