Passkeys are increasingly promoted as replacements for passwords, with websites and platforms encouraging adoption for improved security and convenience. However, according to a detailed technical analysis, passkeys present a significant trade-off: unlike passwords or authenticator apps, users may not retain full control over how they manage these credentials.
The author acknowledges that passkeys can indeed be more secure than passwords. The case for moving away from passwords is straightforward—major organizations have demonstrated poor password practices. SolarWinds famously used “solarwinds123” for critical servers, while Hawaii’s Emergency Management Agency inadvertently exposed credentials via a photograph of a sticky note.
However, the analysis argues that this security problem has already been effectively solved through existing technologies. Two-Factor Authentication via text or email, and more robustly through Time-Based One-Time Passwords (TOTP)—commonly known as authenticator apps—provide strong security without new authentication paradigms. TOTP operates on an open standard (RFC 6238), meaning users can choose any compatible software or hardware to generate codes. Critically, users retain control: they decide where to store seeds, what software generates codes, and can share access with others if desired.
Passkeys, by contrast, operate under the WebAuthn standard and are promoted by the FIDO Alliance, a consortium including major technology companies, governments, intelligence agencies, and banks. According to the analysis, the FIDO Alliance notably lacks consumer advocacy group membership, raising questions about whose interests are prioritized.
The core concern centers on a distinction that the author argues is deliberately obscured: there are multiple technical implementations all branded as “passkeys.” Some function similarly to TOTP—open, user-controlled, and shareable. Others operate differently, potentially giving websites “a hidden dial” to gradually remove user autonomy over credential management.
While passkeys eliminate the need for users to remember or type codes—genuine convenience improvements—the analysis suggests this ease comes at the cost of transparency about how much control users actually retain. Unlike passwords, which users can store anywhere, or authenticator apps, which users can choose freely, passkeys introduce a system where websites themselves may determine usage parameters.
The author does not claim the motivations behind passkey adoption are inherently malicious, but emphasizes that without consumer representation in the development process, user interests may not be adequately protected as the technology evolves.
Key facts
- Passkeys are promoted as more secure and convenient than passwords, addressing real security problems demonstrated by major organizations
- Time-Based One-Time Passwords (TOTP) via authenticator apps already provide robust security and allow users full control over credential management
- The FIDO Alliance, which created passkeys, includes major tech companies, governments, and intelligence agencies but no consumer advocacy groups
- Multiple different technical implementations are all branded as “passkeys,” potentially causing confusion about user control and data management
- Unlike passwords or authenticator apps, users may not retain ultimate control over passkeys, according to the analysis