a user will want to move their passkeys to the Credential Manager of a different vendor or platform. This is currently challenging to do, but FIDO and vendors are actively working to address this issue and we wait to see support for this take hold across the market.

As a prevention method, organizations should consider implementing passwordless practices like fingerprints or facial recognition, as well as modern authentication standards like WebAuthn, which remove passwords from the authentication experience. When organizations opt for these authentication methods, they help to mitigate the risk of stolen credentials, and minimize the chance of account takeovers.

Passkeys Accelerating the Availability of Simpler, Stronger Passwordless Sign-Ins

Also, service providers can offer passkeys without needing passwords as an alternative sign-in or account recovery method.

When a user is asked to sign-in to an app or website, the user approves the sign-in with the same biometric or PIN that the user has to unlock the device (phone, computer or security key). The app or website can use this mechanism instead of the traditional (and insecure) username and password.