Passkey

When a user creates a passkey for a service, their device generates a unique cryptographic key pair, keeping the private key protected in the device's secure hardware and sending only the public key to the service. To sign in later, the service sends a challenge that only the correct private key can answer, and the user simply unlocks their device with a fingerprint, face scan, or PIN to authorize the response, without ever transmitting a password or secret over the network. Passkeys can sync across a user's devices through platform providers or be tied to a single physical security key, depending on the configuration chosen.

Passkeys matter because they directly eliminate the weaknesses that make passwords and even some multi-factor authentication methods vulnerable: there is no password to phish, reuse, or leak in a data breach, and no one-time code that can be intercepted or approved by mistake through MFA fatigue. Major platforms including Google, Apple, and Microsoft have adopted passkeys broadly, and adoption is accelerating across banking and enterprise applications as organizations look for phishing-resistant authentication. For sectors handling sensitive financial or personal data in Indonesia, passkeys represent a meaningful upgrade over password-based login.

Organizations adopting passkeys should provide clear guidance on backup and recovery, since losing the device holding a passkey without a backup method can lock a user out of their account. A gradual rollout that offers passkeys as an option alongside existing authentication, rather than an abrupt mandatory switch, helps employees and customers adjust to the new sign-in flow. Combining passkeys with continued password manager use for services that have not yet adopted them provides strong protection across an organization's full range of accounts.