Passkey.

Passwords have two basic problems: people choose weak or reused passwords, and passwords can be intercepted or harvested on fake pages. Passkeys solve both. During set-up the device creates a key pair. The public key is stored with the service; the private key stays in the device's secure storage or in the password manager. At login the service poses a challenge that can only be solved with the private key — released via Face ID, fingerprint or PIN.

The decisive security advantage: a passkey is bound to the domain for which it was created. A fake login page at a similar address cannot use it, because the browser checks the domain. This makes passkeys largely resistant to phishing, the most common cause of stolen credentials. In addition, there is no secret on the server that could be misused after a data breach — a public key on its own is of no use to attackers.

Apple, Google and Microsoft support passkeys in their operating systems and synchronise them via iCloud Keychain, Google Password Manager or third parties such as 1Password. When you change smartphone, your passkeys come with you. On someone else's computer you can sign in by scanning a QR code with your own smartphone.

For businesses, passkeys are especially interesting for customer portals, admin areas and internal web apps. Introducing them is not simply flipping a switch: you need a fallback for users without a suitable device, management of registered devices and clear instructions. And because the passkey is bound to the domain, the domain has to be settled from the outset.