RIP Passwords? Passkey support rolls out to Chrome stable

Passkeys are here to (try to) kill the password. Following Google's beta rollout of the feature in October, passkeys are now hitting Chrome stable M108. "Passkey" is built on industry standards and backed by all the big platform vendors—Google, Apple, Microsoft—along with the FIDO Alliance. Google's latest blog says: "With the latest version of Chrome, we're enabling passkeys on Windows 11, macOS, and Android." The Google Password Manager on Android is ready to sync all your passkeys to the cloud, and if you can meet all the hardware requirements and find a supporting service, you can now sign-in to something with a passkey.

Passkeys are the next step in evolution of password managers. Today password managers are a bit of a hack—the password text box was originally meant for a human to manually type text into, and you were expected to remember your password. Then, password managers started automating that typing and memorization, making it convenient to use longer, more secure passwords. Today, the right way to deal with a password field is to have your password manager generate a string of random, unmemorable junk characters to stick in the password field. The passkey gets rid of that legacy text box interface and instead stores a secret, passes that secret to a website, and if it matches, you're logged in. Instead of passing a randomly generated string of text, passkeys use the "WebAuthn" standard to generate a public-private keypair, just like SSH.

If everyone can figure out the compatibility issues, passkeys offer some big advantages over passwords. While passwords can be used insecurely with short text strings shared across many sites, a passkey is always enforced to be unique in content and secure in length. If a server breach happens, the hacker isn't getting your private key, and it's not a security issue the way a leaked password would be. Passkeys are not phishable, and because they require your phone to be physically present (!!) some random hacker from halfway around the world can't log in to your account anyway.

So let's talk compatibility. Today passkeys essentially require a portable device, even if you are logging into a stationary PC. The expectation is that you'll use a smartphone for this, but you can also use a Macbook or iPad. The first time you set up an account on a new device, you'll need to verify that your authenticating device—your phone—is in close proximity to whatever you're signing in to. This proximity check happens over Bluetooth. All the passkey people are really aggressive about pointing out that sensitive data isn't transferred over Bluetooth—it's just used for a proximity check—but you'll still need to deal with Bluetooth connectivity issues to get started.

When you're signing in to an existing account on a new device, you'll also need to pick which device you want to authenticate with (probably also your phone)—if both of these devices are in the same big-tech ecosystem, you'll hopefully see a nice device menu, but if not, you'll have to use a QR code.

Second big issue: Did everybody catch that OS listing at the top? Google supports Windows 11 with passkeys—not Windows 10—which is going to make this a tough sell. Statcounter has Windows 11 at 16 percent of the total Windows install base, with Windows 10 at 70 percent. So if you happen to make a passkey account, you could only log in on newer Windows computers.

Passkeys get stored in each platform's built-in keystore, so that's Keychain on iOS and macOS, the Google Password Manager (or a third-party app) on Android, and "Windows Hello" on Windows 11. Some of these platforms have key syncing across devices, and some do not. So signing in to one Apple device should sync your passkeys' access to other Apple devices via iCloud, and the same goes for Android via a Google account, but not Windows or Linux or Chrome OS. Syncing, by the way, is your escape hatch if you lose your phone. Everything is still backed up to your Google or Apple account.

Google's documentation mostly doesn't mention Chrome OS at all, but Google says, "We are working on enabling passkeys on [Chrome for] iOS and Chrome OS." There's also no support for Android apps yet, but Google is also working on it.

Now that this is actually up and running on Chrome 108 and a supported OS, you should be able to see the passkey screen under the "autofill" section of the Chrome settings (or try pasting chrome://settings/passkeys into the address bar). Next up we'll need more websites and services to actually support using a passkey instead of a password to sign in. Google Account support would be a good first step—right now you can use a passkey for two-factor authentication with Google, but you can't replace your password yet. Everyone's go-to example of passkeys is the passkeys.io demo site, which we have a walkthrough of here.