Apple is on a mission to get rid of traditional passwords for good, and a step towards that future is something called "Passkeys." Passkeys aim to entirely replace passwords in both apps and on the web and instead use either your finger or face as the password.
Passkeys are part of iOS 16 and macOS Ventura but also work on non-Apple devices and platforms such as Android and Windows. Apple's goal with Passkeys is to eliminate the need for users to ever type out, remember, or use a password again.
There are two scenarios for Passkeys: when you're using an Apple device and when you're on a Windows or Android device.
On an Apple Device
When you go to a website on your iPhone or iPad running iOS 16 or a Mac on macOS Ventura that supports Passkeys, the website will not prompt you to enter a password as you may expect it to. Instead, you'll simply be asked to authenticate with Touch ID or Face ID.
On a Windows or Android Device
On non-Apple devices, when you go to a website that supports Passkeys, you'll be asked to scan a QR code with your iPhone and then proceed to use Touch ID or Face ID as your actual password.
Passkeys will be more widely supported by apps and websites when iOS 16 and macOS Ventura are released to all users this fall, but there are already some websites that support Passkeys. Here are just a few apps and websites that are starting to roll out support:
- eBay
- Best Buy
- Cloudflare
- Microsoft
- Nvidia
- PayPal
- Carnival
In an interview earlier this month, Apple's director of platform product marketing Kurt Knight said, "This isn't a future dream to replace passwords. This is something that's going to be a road to completely replace passwords, and it's starting now."
Passkeys is just one of several new changes and features coming to iOS 16 and macOS Ventura which you can learn about in our respective roundups.
Top Rated Comments
Please do not spread misinformation about passkeys if you do not have a clue what you are talking about ...
This is the standard reply when Apple introduces something new.
When it’s a feature Android already had (even if worse), the common reply is “iNnOVAtion”.
This will totally change how we authenticate online.
These days, obtaining password via phishing is much more common compared to larger password leaks from companies. Personal data is leaked more often, certainly, passwords, not that much.
To register on a new site, say widget.com
[LIST=1]
* You go widget.com and navigate to its new-account creation page
* Type in what you want your username to be and then click "create account"
* Your phone will bring up a system sheet confirming you want to create a credential for widget.com. After you confirm, the phone will create a site-specific credential token (called "passkey" in FIDO parlance), the security of which is based on public-key encryption.
* The phone will store the token and private-key portion of the token on your iCloud Keychain. It will share the public-key portion of the token with widget.com so it can save it on their server.
Whenever you visit widget.com in the future, Safari will know you have a saved credential for the site and will confirm you'd like to login, similar to how it works today for traditional passwords saved in your keychain, including you proving you have rightful access to your keychain (Face ID, passkey, etc...). But instead of a password, Safari will present the passkey (token) to the site (which it already has stored on their server to compare), then verify you're the rightful owner of the token by proving to the site that your phone has the private key associated with the token (challenge/response).
This is an improvement over passwords because there is no password to be stored on a server or presented for each site, which reduces the attack surface of your credentials. It also solves the problem of weak user passwords, or users reusing their password across multiple sites.