RemotePasskeys
A passkey replaces your password. And it will not work on a fake site.
You sign in with your face, fingerprint or device PIN. There is nothing to type, so there is nothing to phish. Here is how passkeys work, where they are stored, how the credential managers compare, what changes at work, and a readiness check for your business.
Explainer adapted from whatarepasskeys.info under CC BY 4.0, rewritten for Australian businesses. Checked 30 October 2026.
- How passkeys work
- Credential managers compared
- Readiness check
Reviewed by Blake Bath, General Manager, on 30 October 2026.
The problem
Four reasons passwords keep failing.
Every one of them is a shared secret problem. Passkeys remove the shared secret.
They get reused
One password across several accounts means one breach opens all of them.
- Unique per site
- Nothing to reuse
- Nothing to leak
They get stolen from servers
Websites keep password data that attackers take in breaches and crack.
- Site holds a public key
- Useless if stolen
- No hash to crack
They get phished
Fake login pages collect passwords and even one-time codes in real time.
- Origin checked
- Nothing typed
- Fake site refused
They slow everyone down
Resets, text codes and lockouts add friction to something staff do all day.
- Face or fingerprint
- Seconds to sign in
- Fewer resets
Passkey readiness check
Is your business ready for passkeys?
Tick what is true for your Microsoft 365 tenant today. You get the gaps to close, in the order we would close them.
Tick what is true for your business today.
Where you stand
0of 8 steps in place
8 gaps to close.
- Admin accounts use passkeys or security keysAdmins first: one stolen admin account can take the whole tenant.
- Passkeys are enabled in Entra IDStaff cannot register what is not switched on.
- Nobody relies on text message codesMicrosoft stops its SMS and voice MFA on 1 February 2027.
- Conditional Access requires strong sign-in for sensitive appsWithout a policy, people can still fall back to weaker methods.
- There is a recovery processRecovery is where attackers try next.
- Key people have a backup methodOne device is one point of failure.
- You have chosen where work passkeys liveOtherwise passkeys end up in personal accounts.
- Staff have been told what to expectPrompts people do not expect get ignored or refused.
Under the hood
How a passkey works.
Creating a passkey makes two linked keys. One stays with you. One goes to the website.
- Your half stays with youThe private key lives in your credential manager on your own devices and is never handed to the website.
- The website holds the matching halfA public key. On its own it cannot sign anyone in, so there is nothing worth stealing.
- You confirm it is youFace, fingerprint or device PIN, checked on the device. Your biometric never leaves it.
- The site checks where the request came fromThe response is signed together with the website address. A lookalike domain fails that check, so no session is created.
Against the alternatives
Passkeys against passwords, SMS codes and email links.
| Password | Password + SMS code | Email login link | Passkey | |
|---|---|---|---|---|
| Needs a password? | Yes | Yes | No | No |
| Can be phished? | Yes | Yes | Partially | No |
| Can be stolen from a server? | Yes (hash) | Yes (hash) | Partially | No |
| Open to replay attacks? | Yes | Partially | Partially | No |
| Ease of use | Hard to remember | Annoying | Needs email access | A glance or a touch |
Credential managers
Where passkeys are stored, and how the managers compare.
Passkeys live in a credential manager: Apple Passwords, Google Password Manager, Microsoft's, or an independent one. Synced passkeys follow you across devices. Device-bound passkeys, such as on a hardware key, stay on one device.
| Credential manager | Grade and score | Notes |
|---|---|---|
| 1Password | A, 91/100 | Independent. All major platforms. |
| Bitwarden | A, 86/100 | Open source. Free and self-hosted versions. |
| Dashlane | B, 80/100 | Independent. All major platforms. |
| NordPass | B, 78/100 | From Nord Security. |
| Keeper | B, 78/100 | For individuals and businesses. |
| Apple Passwords | B, 74/100 | Built into iPhone, iPad and Mac. Syncs via iCloud Keychain. |
| Proton Pass | B, 71/100 | End-to-end encrypted, from Proton. |
| KeePassXC | C, 67/100 | Open source, offline-first. You manage sync of the database file. |
| Google Password Manager | C, 63/100 | Built into Android and Chrome. Syncs via your Google account. |
| LastPass | C, 56/100 | Independent. All major platforms. |
| Microsoft Password Manager | D, 49/100 | Built into Edge and Windows. Syncs via your Microsoft account. |
| Samsung Wallet (Pass) | D, 49/100 | Built into Galaxy devices. Syncs across Samsung devices only. |
Scores out of 100 by whatarepasskeys.info, last updated 22 September 2026, across ecosystem, platform integration, vault security, credential exchange, interoperability, inheritance and sharing. Real Bytes has not independently tested these scores.
Passkeys at work
Passkeys at work come with tighter rules.
A passkey works the same way at work as at home. The rules around it are usually stricter, because one work account can expose the whole business.
- IT may choose the credential managerAt home you pick. At work, your IT or security team may require a specific credential manager, a managed device or a physical security key so every staff member meets the same bar.
- Extra checks on sensitive systemsFinance, HR and admin consoles may need a PIN, a biometric or a managed device before a passkey is accepted.
- The sign-in screen may look differentYou might be asked to insert a security key, see company branding, or find your personal phone's passkey option is not offered at all.
Running Microsoft 365? Microsoft stops its own SMS and voice MFA on 1 February 2027 (1 July 2027 for Global Administrators) and is prompting users to register passkeys. See the Entra passkey transition guide for the details.
Our view
Admins first, then finance, then everyone.
We roll passkeys out in order of what an attacker would want most: admin accounts first, usually with two hardware keys each, then the people who can move money or change bank details, then the rest of the business.
For staff, a passkey in Microsoft Authenticator on their work or personal phone is usually the easiest start. The bigger job is the recovery process: deciding how someone proves who they are when they lose their phone, so that process does not become the new way in.
The order
Moving a business to passkeys in five steps.
- Step 1Turn on passkeys
Enable the method in Entra ID and pick where they live.
- Step 2Start with admins
Two phishing-resistant methods each, hardware keys if possible.
- Step 3Then finance and executives
The accounts that can move money.
- Step 4Then everyone
Registration prompts with clear instructions.
- Step 5Require it
Conditional Access authentication strength, recovery process written down.
Related guides
Passkeys are the method. Here is the rollout.
The Microsoft dates, the policies and the alternatives.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about passkeys.
Can a passkey be reused on another site?
No. Each passkey is created for one website or app and only works there. That is why a breach at one site, or a lookalike phishing site, gets nothing useful.
What is a passkey?
A passkey is a unique digital key that replaces your password. Creating one makes two linked keys: one stays in your credential manager, the other goes to the website. When you sign in, your device checks your face, fingerprint or PIN, then uses its key to prove it is you. Your private key is never shared.
How is a passkey different from a password?
A password is a secret you remember and type. A passkey is a key stored in your credential manager that you never see or type. Each passkey belongs to one website or app, so it cannot be guessed, phished or reused on other accounts the way a password can.
How is a passkey different from 2FA codes or authenticator apps?
Two-factor authentication usually adds a code after your password. A passkey can replace both the password and the code, because it proves you hold the key and confirms it is you with your face, fingerprint or PIN. Some sites still ask for extra verification depending on how they have set passkeys up.
Is a passkey the same as a security key like a YubiKey?
Not quite. A physical security key can store passkeys, but you do not need one. Most people keep passkeys in the credential manager on their phone or computer. Security keys are an extra option, and many businesses use them for admin accounts and shared workstations.
Does the website get my fingerprint or face scan?
No. Your device uses your fingerprint or face to confirm it is you, locally. Your biometric data never leaves the device and is never shared with the website or app.
Can I use a passkey on a computer that is not mine?
Often, yes. Choose an option like "Use another device" at sign-in. You will usually see a QR code to scan with your phone, which completes the sign-in without saving your passkey on that computer.
What happens if I lose my phone?
It depends on your credential manager. Synced passkeys come back when you sign in to your credential manager on a new device. Passkeys stored on only the lost device are gone, so you would use each site's account recovery process. Check your recovery options before you need them.
Can I move passkeys to a different credential manager?
Increasingly, yes. Moving passkeys uses the FIDO Credential Exchange standard, and support depends on both managers. Check the credential exchange column in the scorecard above before you commit to one.
If someone steals my phone, can they get into my accounts?
Only if they can also unlock the phone with your face, fingerprint or PIN, because that check is needed to use any passkey on it. That is far harder for a remote attacker than stealing a password.
Next step
Want passkeys rolled out without the lockouts?
We set up the methods and policies, start with your admins, write the recovery process, and walk staff through registration.
Keep reading
- Entra passkeys The Microsoft dates.
- MFA Phishing-resistant methods.
- Passwordless Hardware keys and Windows Hello.
- Identity and access Our service.
Reviewed by Blake Bath, General Manager, on 30 October 2026. Explainer content and credential manager scores adapted from whatarepasskeys.info by the passkey community, used under CC BY 4.0 and rewritten for an Australian business audience. Checked 30 October 2026. whatarepasskeys.info (CC BY 4.0); Creative Commons, CC BY 4.0 licence; FIDO Alliance, Passkeys; W3C, Web Authentication Level 3; MDN, Passkeys