Every login screen with a password field carries the same costs: reset emails, locked accounts, and a database of hashes that attackers want. Passkeys remove most of that. They're also easier for your users. In the FIDO Alliance's October 2025 Passkey Index, companies including Google, Amazon and PayPal reported a 93% sign-in success rate with passkeys against 63% for other methods, and sign-ins took 8.5 seconds instead of 31.2 with traditional MFA.
What a passkey is
A passkey is a key pair. The private key stays on the user's device or in their password manager (iCloud Keychain, Google Password Manager, 1Password and others sync them). Your server stores only the public key. To sign in, the device proves it holds the private key, usually after a fingerprint, face scan or device PIN.
Two things follow. Your server has nothing worth stealing, because a public key can't sign anyone in. And phishing doesn't work, because the browser only offers the passkey on the real domain.
How we add them to an existing app
We don't rip out passwords. We add passkeys alongside them and let users move over at their own pace.
- Registration from the account page. A signed-in user clicks "Add a passkey". The browser handles the prompt. We store the credential ID and public key against the user, plus a label so they can see which device it belongs to.
- Sign-in with autofill. On the login page, the username field supports passkey autofill. Users who have one see it offered; everyone else sees the normal form.
- A nudge after password login. After a successful password sign-in, we offer to create a passkey. This is where most adoption comes from.
- Management. Users can list and remove passkeys. Account recovery still works through email, so losing a phone doesn't lock anyone out.
On the server we use a maintained WebAuthn library for the platform (for example SimpleWebAuthn for Node or py_webauthn for Python). Writing the cryptographic checks yourself is a bad idea.
Details that trip teams up
- The relying party ID. Passkeys bind to a domain. Decide early whether they should work on
app.example.comonly or acrossexample.com, because changing it later invalidates existing passkeys. - Recovery is now your weakest link. If "forgot password" emails a magic link, that email account protects every user. Rate-limit it and alert on unusual volume.
- Shared and older devices. Some users sign in from shared office machines. Keep the password or email-code path working for them.
- Admin accounts first. Start by requiring passkeys or hardware keys for staff and admin logins. That's where phishing hurts most, and it lets your team learn the flow before customers see it.
Is it worth it for a small business?
If your users sign in more than once a month, yes. Fewer failed sign-ins means fewer support tickets, and removing passwords for part of your user base shrinks the damage of a credential-stuffing attack. Passkeys can be added as an option without immediately replacing the existing login flow, though the effort depends on your authentication system.
Sources: FIDO Alliance Passkey Index, October 2025, FIDO Alliance: Passkeys.
