Since the very beginning of the Internet, website and application developers have relied heavily on passwords as a way to protect user accounts.

But as hackers develop more and more sophisticated techniques to bypass security measures, passwords are becoming easier to crack, especially with the help of powerful GPU processors and AI systems. A recent study showed that a single GPU can crack a password of ten characters in a second or less. The vulnerability of password-protected user accounts has prompted many companies to look for alternatives. One of these alternatives is passkeys. But do they really offer better security?

Passkeys are different from passwords. Unlike passwords, which enable authentication by entering letters, numbers and special characters or a combination thereof, passkeys enable access using a PIN code, facial recognition or fingerprint. So you don't have to remember a string of characters.

Both passwords and passkeys can use multi-factor authentication (MFA). Passkeys protect users with built-in MFA verification that requires proving at least two things. First, that you can access the device that holds your private key, and second, that you can unlock the device or account with your biometrics or PIN code. Depending on the system, the use of passwords sometimes requires MFA in addition, where a code is sent to the user via email, SMS or an authentication application.

Which is a more secure system, MFA with password or MFA with passkeys If someone tricks you into opening a fake page that looks like the real one, and you enter your password, attackers can steal it along with your real-time MFA code and use it to access your account. This is not difficult for experienced hackers to do. We've previously reported how hackers are bypassing MFA restrictions using sophisticated malware that creates the illusion of a normal login process.

However, with passkeys the outcome is different. Even if an attacker tricks you into using a PIN, facial recognition, or fingerprint on a fake page, your device will recognize that the page is fake, making data theft very difficult or impossible.

How passkeys recognize fake pages is explained by a process called domain binding. When you create a passkey for a site, a public and private key is generated that is tied to the domain of that site. Unlike people who sometimes cannot distinguish between similar URLs, your device will never reveal the private key if the URL is not exactly the same. The public key is usually stored on the server and the private key is stored locally on the device. If there is a data breach on the server, attackers can obtain the public key, but it is worthless without the private key stored securely on your device. So a data breach does not compromise your account.

Although a PIN can be used to activate the passkey system, it has a different role than a password. When you use a PIN for authentication, it only unlocks your private key, which is then used in combination with your real password. Unlike passwords, which are stored as encrypted values ​​on the server and can be discovered during an attack, PINs and private keys are never stored on the server. Only your device knows the private key and it remains unknown to everyone, including you, making it nearly impossible to compromise.

Companies such as Google, Apple and Microsoft have adopted and promote passkeys technology. In April 2025, Microsoft optimized the login process to use the passkeys system. Although no one claims that passkeys are 100% secure, it is clear that they are generally more secure than passwords because they protect users from the many social engineering tricks used by hackers.