“Passwords will soon be gone” has been promised for twenty years. Now the promise has a working technical basis for the first time — the passkey. Here is what it is, how it differs from a fingerprint, and why passwords are not going anywhere yet.
La huella y la cara no son un sustituto
A common misconception. When you unlock a phone with a fingerprint you are not “logging in with a fingerprint” — you are opening access to a secret stored in the device. Biometrics replaces not the password but the PIN to local storage.
Hence an important consequence: a fingerprint works only on your own device. It is never sent to a server and cannot log you in on someone else’s computer.
Cómo funciona una passkey
At registration the device creates a key pair: the private key stays with you, the public one goes to the service. At login the service sends a random challenge, the device signs it with the private key and the service verifies the signature.
What that gives in practice:
Nothing to steal on the service side. The database holds a public key, useless on its own. A leak of such a database gives an attacker nothing — unlike a database of password hashes.
Phishing stops working. The key is bound to a domain. On a fake page the device simply finds no matching key and signs nothing — you physically cannot hand over the secret.
Nothing to type. There is no field to type into the wrong place.
Dónde está el truco
Recovery. The central question. You lose the only device holding the key — how do you get in? Services answer differently: cloud key sync, backup codes, or falling back to a password. The last one is ironic: the password remains as a spare entrance, and therefore as a weak point.
Ecosystem lock-in. Keys sync inside Apple, Google or a password manager, and moving between them is still awkward.
Patchy support. Large services have adopted it; most others have not and will not soon.
Qué hacer ahora
Enable passkeys where offered, especially for email and banking. It usually adds a login method rather than replacing one.
Do not delete the password until you have confirmed that recovery works.
Save the backup codes in a password manager, not as a screenshot on the phone that will be the thing you lose.
And a sober forecast: for the next few years most services will still use passwords. A unique long password and a second factor remain the main thing; passkeys are added on top where available.