By Bushra Ali

Writer/Reporter

Think about how many passwords you have. Your email has one. Your bank has one. Social media, shopping websites, streaming services and probably dozens of other accounts all ask you to create something that you are supposed to remember but you are also told that it should be long, complicated and different from every other password.

It is a system that has been around for decades. But it may not be around forever. Tech companies are increasingly moving towards a different way of logging in: passkeys. Instead of asking to put in your password, it now asks you to verify yourself using something already built into your phone or computer such as your fingerprints, face recognition or device PIN. The passkey itself is a cryptographic credential stored on your device or synced across your devices. You may have already used one without realizing it. The experience is simple. You open a website, select “Sign in with your passkey,” and your phone asks you to use Face ID, a fingerprint or your screen lock. There is no password to type, and importantly, there is no password for a phishing website to simply collect.

The last part is one of the biggest reasons security experts are interested in passkeys. Traditional passwords are not phishing resistant. Passkeys use cryptographic authentication that can be tied to the specific website you are trying to access, making them much harder for an attacker to steal through a fake login page. That doesn’t mean passwords are suddenly unsafe or disappearing tomorrow. For now, passwords are still everywhere. Many websites do not support passkeys, and people still need passwords for accounts and services that have not made the transition.

Another reason the change may take time is that people will have to understand the new system. Passkeys work differently because complicated security happens behind the scenes. Your device stores a cryptographic key while the website keeps a corresponding public key. When you sign in, the two sides work together to verify that you are the person who owns the account. The transition is already gaining momentum, with organizations either having passwordless authentication in place or actively pursuing it, which shows that it is becoming a serious direction for workplaces as well as consumers.

The irony is that the future of logging in may feel less technological, not more. Instead of trying to remember another complicated combination of letters, numbers and symbols, you may simply look at your phone, or touch its screen. The password is not completely gone, but the days of trying to remember which password belongs to which account may slowly be coming to an end.