Wild World Web
We don't have to live with the nightmare of passwords. There is a better way
By Rob Pegoraro The Washington Post
Published Oct. 14, 2026
Contact The Editor
Articles By This Author
One of the few times you can reliably see a human smile after logging into a site is in a hacker movie, when the hoodie-clad hero sees their exploit work and smugly pronounces, "I'm in!"
One of the others is when passkey authentication — a relatively new way of logging into websites and apps — works as advertised.
I don't need to remember or type a password. Instead, a silent, swift exchange of cryptographic credentials allows a site and my computer to verify their identities and my access. I confirm that by touching my device's fingerprint sensor — and boom, I'm in.
Three years ago, Google made passkey authentication the default for consumer accounts, freeing Gmail users from having to depend on passwords. But many sites still don't offer it, or they treat it as a security side quest. And the software and hardware to streamline passkey use remains incomplete.
To rework one of the more memorable sentences published in consumer-tech journalism: Passkeys can still be too hard to use, and it isn't your fault.
What passkeys do that passwords can't
Passkeys retire passwords — and the need to remember them. You no longer face the risk that an attacker can obtain one of these precious bits of information.
Instead, passkeys rely on pairs of digital keys using a standard overseen by a trade group called the Fast Identity Online Alliance (FIDO). When you create a passkey for a site, that site stores a unique public key for you. Software on your device, usually your browser or a password manager, saves a corresponding private key. You don't have to memorize anything.
When you next visit that site using whatever software saved your passkey, the site will ask for proof that you have the passkey. The software sends a signature generated from the private key — not the private key itself.
Finally, you confirm that you're in charge, usually with the fingerprint or face-recognition biometric security you already use to unlock your device.
This neatly solves the old problem of phishing attacks by fraudsters seeking to trick you into typing a password at an impostor site , because a passkey session can only start at the correct site.
This also dispenses with the need to verify your password log-in via a one-time code sent to one of your devices — an increasingly inescapable routine with online accounts.
Passkeys can't solve the problem of somebody stealing your computer and forcing you to unlock it. But if that happens, you have a much bigger problem — and in the meantime, passkeys themselves face issues that you as an individual can't solve.
Inconsistent support, even among competitors
Major email and cloud services quickly rolled out passkey authentication to reduce account takeovers. Big online retailers like Amazon, Walmart and Best Buy soon followed, seeing a chance to keep customers who struggle with passwords from leaving their sites.
But passkey deployment among other sites remains irritatingly uneven. For almost every name brand listed in passkey-support lists like the FIDO Alliance's directory, you can find multiple competitors that ignore passkeys.
Hotels? Hyatt supports them while Hilton, IHG and Marriott do not. Airlines? Air France and Air New Zealand are in, while U.S. carriers are out. The regional bank I use for business welcomes passkey log-ins; the much larger banks I deal with do not.
Passkey-compatible sites generally still require passwords as a backup option if you lose a device with a passkey, but too many of them (see, for example, LinkedIn) continue to show passwords as their default log-in. Others (in my experience, Facebook and Login.gov) outright require you to log in with a password before letting you confirm that by using your passkey instead of a two-factor code.
Many sites that have ignored passkeys instead try to solve their security problem by making you do more work: They impose multifactor authentication on every sign-in.
The worst among them only send those one-time codes via email or text, then force you to type each character instead of pasting in the entire code. They might as well announce, "We hate our users, especially the ones with any dyslexia." You can expect them to be the last in the world to support passkeys.
Spotty support on devices
Living the passkey life is easiest if you confine your computing to one company's platform — and if every device you use supports biometric authentication.
If one doesn't let you sign in with your fingerprint or your face — a regrettably common scenario in low-end laptops and even higher-end desktops — each passkey log-in there will demand whatever passcode you use to unlock the machine. That gets old rapidly.
The simplest possible passkey scenario is to use only one browser and have that manage passkeys, but things stay relatively simple with multiple devices if you don't mix platforms.
You only use Macs, iPhones and iPads? Apple's Passwords app will do. You instead rely on Google's Chrome browser and Android and ChromeOS operating systems? Google Password Manager works.
But if you split your screen time — in my case, among a Mac desktop, a Windows laptop, an Android phone and an iPad mini — you will need a password manager that can sync them among all those systems.
Most cross-platform password managers come with an annual subscription; Bitwarden, however, does not and consistently earns positive reviews from sites that I trust. I, meanwhile, use 1Password in part because that service provides free service to journalists.
One more thing
Password managers themselves were supposed to solve our security problems by flagging weak and reused passwords, making it easy to generate, save and use complex passwords, and only auto-filling them at the right sites.
But even a good password manager can't stop a stressed or tired user from ignoring warnings about mismatched domain names and pasting in a password at a phishing site. And AI is only making phishing lures more convincing.
Multifactor authentication was also supposed to cure the phishing plague, but fraudsters figured out soon enough how to copy codes entered at look-alike sites into the correct ones.
And before then, we had silly IT-department dogma like "change your password every 90 days."
So if you see yet another round of security advice that involves changing how you log into sites — and then think "Really? Again?" — your annoyance at an industry that keeps failing you is not your fault.
But passkeys really do work. I mean it this time.
(COMMENT, BELOW)
Every weekday JewishWorldReview.com publishes what many in the media and Washington consider "must-reading". Sign up for the daily JWR update. It's free. Just click here.