Every customer visit starts with the same question, even if they never ask it out loud: what am I actually protecting, and with what? Here's the plain-language version.
What is a password?
A password is a secret string of characters that proves you are you. The problem: it's a shared secret. The website has to store a copy (usually scrambled/"hashed") to check it later, you have to remember or record it, and anyone who obtains it — by guessing, by a data breach at the website, or by tricking you into typing it into a fake site (phishing) — can use it exactly as well as you can.
Say this to a customer"A password is like a house key that a copy of gets left at every store you shop at. If any one of those stores gets robbed, someone now has a key to your house."
What is a passkey?
A passkey is a pair of mathematically-linked keys created on your device: a private key that never leaves the device (or your Keeper vault), and a public key that gets handed to the website. Signing in means your device proves it holds the private key — the website never sees, stores, or can leak the secret itself.
🖼️ Screenshot not uploaded yet — KeeperFill offering to save a brand-new passkey On a site that offers passkeys, screenshot the moment KeeperFill offers to store the new passkey. A trainer can add it at /admin/screenshots.
Say this to a customer"A passkey is like your fingerprint unlocking a lockbox that only your phone or computer holds. Nobody else ever gets a copy of it — there's nothing for a hacker to steal from the website's side."
Why isn't everything a passkey already?
Not every website supports them yet — adoption is growing fast but it's not universal.
Customers are used to passwords and need a little hand-holding the first few times.
Some workflows (shared logins, very old systems) still require a password.
That's why the plan for most customers is: strong unique password + Keeper autofill everywhere, and passkey on any site that offers one.
How Keeper fits in
When a customer signs in anywhere, the KeeperFill browser extension notices and offers to save the login.
🖼️ Screenshot not uploaded yet — KeeperFill's save-login prompt Right after a customer signs in somewhere new, KeeperFill pops up asking to save the login. Screenshot that popup. A trainer can add it at /admin/screenshots.
The record lives encrypted in their vault, and syncs to every device signed into Keeper.
🖼️ Screenshot not uploaded yet — A saved record open in the Web Vault Open any record in vault.keepersecurity.com and screenshot the field layout (title, login, password, URL, notes). A trainer can add it at /admin/screenshots.
Next time, Keeper fills the password (or the passkey) automatically — the customer never has to remember or retype it.
When it's time to change a password, Keeper's built-in generator makes a long random one and updates the record at the same time.
🖼️ Screenshot not uploaded yet — The password generator panel Click the Keeper icon in a password field and screenshot the Generate panel (length slider, character options). A trainer can add it at /admin/screenshots.
How to tell them apart at a glance
Weakest
A short, reused, or common password (birthday, pet name, "password123"). Guessable and reused everywhere.
Better
A long, unique, random password (Keeper-generated), used nowhere else. Not guessable, but still a secret that could theoretically be phished.
Better still
The same, plus two-factor authentication. Even a phished password isn't enough on its own.
Best
A passkey. Nothing to type, nothing to phish, nothing shared with the website at all.
Practice all four of these in the Training Track's Password, 2FA and Passkey missions.
Simple Technologies · Login Lab — a training sandbox. Nothing here is a real account. · Guides · Training Track