Passkey

Passkey is a passwordless sign-in method. Your phone or laptop stores a cryptographic key, confirms it’s you (Face ID, fingerprint, or device PIN), and proves that to the site — without sending a password that can be stolen, guessed, or reused. The face or fingerprint check is biometric authentication. It unlocks the passkey. It is not the passkey.

The private key never leaves the device. The passkey is bound to the real domain, so a lookalike phishing page cannot collect it the way it can collect “letmein123.” Login still rides on HTTPS / SSL. Until every tool supports passkeys, two-factor authentication is the extra lock that blocks credential stuffing. For e-commerce, a forgotten password at checkout is a common path to cart abandonment. Platforms like Shopify and WooCommerce may already offer passkeys through the platform or an identity plugin — add them as an option; don’t yank passwords overnight.

A real-life example of a passkey

A Decatur boutique customer hits “Pay,” then “forgot password,” then closes the tab. Next visit they unlock the same way they unlock their phone. Support tickets drop; the stolen-password dump from some other site no longer opens this account.

Start with staff tools (Google Workspace, Microsoft 365), then customer login. See Passkeys vs. Passwords, Web Wise: How Can I Keep My Website Secure?, and defense against credential stuffing.