A passkey is a password replacement that lets you sign in with your fingerprint, face or device PIN. It's built so it can't be phished, guessed or leaked in a data breach, which makes it one of the strongest ways to protect an email account. For most people, the answer to "is it time to ditch passwords?" is: start using passkeys wherever your email provider supports them, but keep a secure backup sign-in method for now.
Your email account is the master key to your digital life. Whoever controls it can reset the passwords for almost everything else. That's why moving it beyond passwords matters more than for any other account.
Passkeys replace typing a password with unlocking your device.
They resist phishing because each passkey only works on the real website it was created for.
Nothing secret is stored on the server, so a breach doesn't expose a reusable password.
Many major providers already support them, including the account systems from Google, Microsoft and Apple.
There are limits: older email apps that use IMAP or SMTP may still need a password or app-specific password.
Keep a backup, such as a second passkey, a security key or recovery codes, in case you lose your device.
What is a passkey, and how does it work?
A passkey is a digital credential based on open standards from the FIDO Alliance and the W3C (known as FIDO2 and WebAuthn). When you create one, your device generates a matching pair of keys:
A private key, which stays on your device or in your password manager, protected by your fingerprint, face or PIN.
A public key, which is stored by the service you sign in to. On its own it can't be used to sign in.
When you sign in, the two keys prove they belong together without the private key ever being sent anywhere.
[embed: node/e5dd8bd6-6e0f]
Two details make this far safer than a password:
Each passkey is tied to one website. Your device will only use it on the real domain it was created for, so a look-alike phishing page simply can't trigger it.
There's no shared secret to steal. If the email provider is breached, attackers get public keys, which are useless for signing in.
Passkeys can be stored on a single device (such as a hardware security key) or synced across your devices through a platform account or password manager, so a new phone can use the same passkey.
Passkeys vs passwords vs two-factor authentication
Password only | Password + 2FA code | Passkey | |
|---|---|---|---|
What you do to sign in | Type a password | Type a password, then a code | Unlock your device |
Can be phished on a fake site | Yes | Often (codes can be relayed) | No, tied to the real site |
Exposed in a server breach | Yes, if poorly stored | Password yes, code no | No, only a public key |
Can be guessed or reused | Yes | Password yes | No |
Ease of use | Easy to forget | Extra step | Fast once set up |
Works in older IMAP/SMTP apps | Yes | Usually via app password | Often not yet |
Two-factor authentication is a big step up from a password alone, and hardware security keys are among the strongest options. Passkeys use the same underlying technology as those keys but make it easier for everyone.
The benefits
Phishing protection built in. The most common way email accounts are stolen, a fake login page, stops working.
No passwords to remember, reuse or rotate.
Faster sign-in, usually a single fingerprint or face scan.
Less damage from breaches, because there's nothing reusable on the server.
The limitations (be honest about these)
Support is still uneven. Not every email provider, app or older device supports passkeys yet.
Desktop and third-party mail apps that connect over IMAP or SMTP may still need a password or app-specific password. Our guide to IMAP vs SMTP vs API explains how those connections work.
Recovery depends on your setup. If your only passkey is on a lost device and you have no backup, getting back in can be slow.
Synced passkeys rely on the security of the account that syncs them, so protect that account well too.
Shared mailboxes need planning, because a passkey belongs to a person's device rather than a shared password.
So, is it time to ditch passwords entirely? Not quite for everyone. But for your most important accounts, starting with email, passkeys are worth adopting now alongside a solid backup.
How to start using passkeys for your email
The exact menus differ by provider, but the process is similar everywhere.
Check support. Open your email account's security settings and look for "Passkeys," "Passwordless sign-in" or "Security keys." If your provider's help pages mention passkeys, follow their steps.
Secure your device first. Make sure your phone or computer has a screen lock (fingerprint, face or PIN) and is up to date.
Create the passkey. Choose to add a passkey and confirm with your fingerprint, face or PIN. Your device or password manager saves it.
Add a second passkey or security key. Register a passkey on another device, or a hardware security key, so losing one device doesn't lock you out.
Save your recovery options. Store recovery codes somewhere safe and offline, and keep your recovery phone number or address current.
Test it. Sign out and sign back in with the passkey before you rely on it.
Review your other sign-in methods. Once passkeys work, consider whether your provider lets you make them the default or remove weaker options such as SMS codes.
Keep a backup, always
Backup option | Good for |
|---|---|
A second synced device | Losing or replacing your phone |
A hardware security key | Strong, offline backup that works across devices |
Recovery codes | Last-resort access if every device is lost |
Up-to-date recovery email or phone | Provider-assisted account recovery |
If you also use email in a desktop app over IMAP or SMTP, check whether your provider requires an app-specific password for it, and keep that password unique and stored securely.
For businesses: rolling out passkeys across your team
For a company, the biggest win is shutting down phishing-based account takeovers, the starting point for many business email compromise scams. Our post on auto-forwarding work email shows how attackers exploit a stolen mailbox.
A practical rollout looks like this:
Start with high-risk accounts: admins, finance, executives and anyone who approves payments.
Require two-factor authentication for everyone first. It's the foundation passkeys build on, and security keys are a strong option where passkeys aren't available yet.
Pilot with one team, document the steps, and collect questions before a wider rollout.
Plan recovery. Decide how staff regain access if they lose a device, and make sure that process can't be abused by someone pretending to be an employee.
Handle exceptions. Shared mailboxes, older devices and IMAP-based apps may need app passwords or other controls for a while.
Train people. Explain what a passkey prompt looks like and that IT will never ask them to approve a sign-in they didn't start.
Update offboarding so passkeys and security keys are removed when someone leaves.
Pair passkeys with the other layers that protect business mail: domain authentication with SPF, DKIM and DMARC, encrypted connections, and awareness of phishing. Our guides to email security and phishing protection and email encryption for business cover those.
FAQ
What is a passkey?
A passkey is a sign-in credential that replaces a password. It uses a pair of cryptographic keys: a private key kept on your device, unlocked with your fingerprint, face or PIN, and a public key stored by the website or service.
Are passkeys safer than passwords?
Yes, in most situations. Passkeys can't be guessed or reused, are designed to resist phishing, and aren't exposed in a server breach the way passwords can be.
Do passkeys replace two-factor authentication?
A passkey combines something you have (your device) with something you are or know (your fingerprint, face or PIN), so it already provides strong, multi-factor protection in a single step.
What happens if I lose my phone?
If your passkeys are synced, you can use them on your other devices. Otherwise, use a backup passkey, security key or recovery codes. That's why setting up a backup before you need it matters.
Can I use passkeys with any email provider?
Not yet. Support is growing, and several major providers already offer it, but check your own provider's security settings or help pages.
Do passkeys work with Outlook, Thunderbird or other desktop mail apps?
It depends on the app and how it connects. Apps that use IMAP and SMTP may still need a password or app-specific password even if your account uses passkeys for web sign-in.
Can my biometric data be seen by the email provider?
No. Your fingerprint or face is checked locally by your device. The service only receives proof that the device unlocked the passkey.
Protect your business email beyond passwords
Strong sign-in is only one layer. NevTan Mail is secure business email on your own domain, with two-factor authentication including hardware security keys, end-to-end and zero-access encryption, TLS on every connection, and Sentinel monitoring for suspicious account activity. Learn more on our security page.
Check business email pricing, start with free business email, or see how NevTan compares as a Proton Mail alternative or a Google Workspace alternative.
