The Password Is Dead. It Just Doesn't Know It Yet.
Let me guess: you have somewhere between 50 and 200 passwords. Some of them are strong (the ones your password manager generated). Some of them are embarrassing (the ones you've been using since 2009). And a few of them are shared across multiple accounts because, honestly, who can remember a unique 16-character string for every single service?
You're not alone. 81% of data breaches involve weak or stolen passwords. 65% of people reuse passwords across sites. And 23 million people—I wish I were making this up—use "123456" as their password. The entire security model that underpins most of our digital lives is fundamentally broken.
Passwords put security and convenience at direct odds. Strong passwords are impossible to remember. Memorable passwords are trivial to crack. Password managers help but add complexity. Multi-factor authentication helps more but adds friction. We've been patching a flawed system for decades. Passkeys finally fix it.
What Passkeys Actually Are (In Plain English)
Forget the cryptography jargon for a moment. Here's how passkeys work from a user's perspective:
You want to log in to a website. Instead of typing a password, your phone or laptop asks for your fingerprint or face scan. You provide it. You're in. That's it. No password to type, no code to enter, no token to find. Just you, proving you're you, in about two seconds.
Under the hood, passkeys use public-key cryptography—the same technology that secures online banking. When you create a passkey, your device generates a key pair. The private key stays on your device, protected by your biometrics. The public key goes to the website. To log in, your device proves it has the private key without ever revealing it. Even if someone hacks the website's server and steals the public key, it's useless without the private key on your device.
This means phishing is impossible. An attacker can create a perfect fake login page, but without your physical device and your fingerprint, they can't authenticate. The passkey is bound to the real website—it simply won't work on a fake one.
The State of Play in 2026
Passkeys have moved from "interesting experiment" to "mainstream" remarkably quickly. Every major platform supports them: Windows, macOS, iOS, Android. Every major browser: Chrome, Safari, Edge, Firefox. And the list of services accepting passkeys reads like a who's who of tech: Google, Apple, Microsoft, GitHub, PayPal, Amazon, eBay, and hundreds more.
For businesses, the implications are significant. Azure AD (Entra ID) supports passkeys natively. That means your employees can log in to Microsoft 365 without a password—using their face or fingerprint on any modern device. No more forgotten passwords, no more password reset tickets, no more phishing-vulnerable credentials.
The numbers from early adopters are striking. Password reset requests drop by 80-90%. Phishing-related incidents essentially disappear. Login times decrease from an average of 30 seconds (password + MFA code) to about 2 seconds. And user satisfaction goes up—because nobody actually enjoys typing passwords.
Rolling Out Passkeys in Your Organisation
The transition doesn't have to be abrupt. In fact, it shouldn't be. Here's the approach that works.
Start by enabling passkeys as an additional option alongside passwords. Let your IT team go first—they'll field questions later and need to understand the technology. Then expand to tech-savvy volunteers across departments. Let them use passkeys for a month, gather feedback, and refine your approach.
Once you're confident, encourage everyone to add passkeys. A gentle nudge at login—"Want to set up fingerprint login? It takes 10 seconds"—converts most users within a few weeks. People like things that are faster and easier, and passkeys are both.
The final step—making passkeys mandatory and retiring passwords—can come later, once adoption is high and recovery processes are solid. For most organisations, this takes 6-12 months from first pilot to full deployment.
The Objections (And Why They Don't Hold Up)
"What if I lose my device?" Valid concern, simple solution. Register passkeys on multiple devices—your laptop and your phone, for instance. If you lose one, the other still works. Additionally, recovery codes (stored securely, printed, and locked away) provide a backup path.
"What about shared accounts?" Shared accounts are a security problem regardless. The right solution is giving each person their own passkey to the same service, with proper access management. If that's truly impossible, a shared password manager still works for the exceptions.
"Our applications don't support passkeys." If they support modern identity providers (Azure AD, Okta, etc.), they support passkeys through federation. For truly legacy applications, an identity proxy can bridge the gap. And for custom applications, WebAuthn libraries are available for every major framework.
"Our employees won't accept the change." In our experience, the opposite is true. Employees are tired of passwords. When you offer them a way to log in with their fingerprint instead of typing a 16-character string and then waiting for an MFA code, adoption is enthusiastic, not reluctant.
The Bottom Line
Passkeys aren't a future technology. They're here, they're mature, and they solve a problem that's been plaguing IT security for decades. The transition is straightforward, the user experience is superior, and the security improvement is dramatic.
Every week you wait is a week your organisation remains vulnerable to phishing, credential stuffing, and password reuse—attacks that passkeys eliminate entirely.
The password is dead. Time to bury it.
*Want to roll out passkeys in your organisation? We'll help with the strategy and implementation. Schedule a conversation*
