← All guides

Passwords vs. Passkeys

Every visit answers the same question, even when nobody asks it out loud: what is protecting this account, and is it any good?

What a password really is

A password is a secret you and the website both hold. That is the flaw. The website keeps a copy to check against, and anyone who obtains that copy can use it exactly as well as the customer can.

One password, copied everywhere A password is a shared secret. Every site you give it to keeps a copy. your password Email same password Shop same password Forum breached Bank same password Attacker has the list The forum gets breached. Now the attacker tries that password on the email, the shop and the bank. This is credential stuffing, and it is how most account takeovers actually happen. Fix: a different random password per site, so one breach leaks exactly one account.
Say this to a customer"A password is like a house key you've left a copy of at every store you've ever shopped at. If any one of those stores gets robbed, someone now has a key to your house — and the first thing they'll try is your front door."

Two things follow, and they are the whole argument for a password manager:

The generator KeeperFill opens right inside a password field
The generator KeeperFill opens right inside a password field
The same generator inside the vault
The same generator inside the vault

What a passkey is

A passkey replaces the shared secret with a key pair. The private half never leaves the device or the vault. The website only ever holds the public half, which is useless to a thief.

Registration — done once Signing in — every time after Your device makes a key pair 🔒 private 🔓 public The website stores 🔓 public only 🔓 🔒 stays put device or Keeper Nothing secret was ever sent or stored on the website. Website sends a random challenge You approve face / print / PIN 🔒 signs it signature only Website checks it with 🔓 public key A fake site cannot use the signature: it is bound to the real domain. That is why passkeys cannot be phished.

To the customer it is simply a fingerprint, a face, or a device PIN:

Unlocking with Windows Hello — nothing typed
Unlocking with Windows Hello — nothing typed

Stored in Keeper, a passkey follows them to every device instead of being stranded on one laptop:

A passkey held inside a Keeper record
A passkey held inside a Keeper record
Say this to a customer"A passkey is your fingerprint opening a lockbox only your device holds. The website never gets anything worth stealing, and a fake login page can't use it, because the key refuses to work on the wrong address."

The part that sells it: phishing

A strong password still fails if the customer types it into a convincing fake page. A passkey does not, because the signature is cryptographically tied to the real domain. This is the single most useful thing you can explain to a nervous customer.

So why isn't everything a passkey?

So the plan is: a unique generated password in Keeper everywhere, and a passkey wherever it is offered.

How to grade what you find

Weakest
Short, reused or guessable. Assume it is already on a list somewhere.
Better
Long, random, unique, stored in Keeper. Not guessable, still phishable.
Better still
The same plus two-factor, so a phished password alone is not enough.
Best
A passkey. Nothing to type, nothing to phish.
Security Audit — strength and reuse across the whole vault
Security Audit — strength and reuse across the whole vault
A saved record open in the Web Vault
A saved record open in the Web Vault

Go deeper

Keeper product screenshots from Keeper Security's partner asset pack. Internal Simple Technologies training material, covered by NDA — not for redistribution.

Simple Technologies · Login Lab — a training sandbox. Nothing here is a real account. · Guides · Training Track