Passkey

Passkey is a passwordless sign-in method. Your phone or laptop stores a cryptographic key, confirms it’s you (Face ID, fingerprint, or device PIN), and proves that to the site — without sending a password that can be stolen, guessed, or reused.

The private key never leaves the device. The passkey is bound to the real domain, so a lookalike phishing page cannot collect it the way it can collect “letmein123.” Login still rides on HTTPS / SSL. For e-commerce, a forgotten password at checkout is a common path to cart abandonment. Platforms like Shopify and WooCommerce may already offer passkeys through the platform or an identity plugin — add them as an option; don’t yank passwords overnight.

A real-life example of a passkey

A Decatur boutique customer hits “Pay,” then “forgot password,” then closes the tab. Next visit they unlock the same way they unlock their phone. Support tickets drop; the stolen-password dump from some other site no longer opens this account.

Start with staff tools (Google Workspace, Microsoft 365), then customer login. Security context: Web Wise: How Can I Keep My Website Secure? and defense against credential stuffing.