Hardware keys, passkeys, and the passwordless future

FIDO2 comes in two concrete forms: physical hardware keys and synchronized passkeys. Together, they outline a future in which the password disappears.

Hardware keys

A physical security key (for example a YubiKey) is a small object, often in USB or NFC form, that contains and protects the private keys. You plug it in or hold it near the phone, tap it, and authentication takes place.

Advantages: the private key is locked inside a hardware component it never leaves; it resists computer theft and malware. Limitation: it is an object you must not lose, and you need to provide a backup one.

Passkeys

A passkey is a FIDO2 key synchronized across your devices via the system's encrypted keychain. Created on the phone, it appears on the computer and the tablet.

The benefit: the same level of resistance to phishing, without depending on a single object. Losing a device does not lose the passkey, which is restored from the encrypted keychain. This is what makes the technology usable by the general public.

Passwordless login

Hardware keys and passkeys make it possible to log in without any password. A gesture (tap, fingerprint, face) unlocks the private key, which signs the challenge.

This removes several risks: nothing to guess, nothing to reuse from one site to another, and above all no exploitable secret on the server side. A leak of the database delivers only public keys, worthless to an attacker.

Comparison of the three approaches

+---------------------+------------------+------------------+-------------------+
| Criterion           | Password         | TOTP (6 digits)  | FIDO2 / passkey   |
+---------------------+------------------+------------------+-------------------+
| Resistance          | None             | Weak: code       | Strong: signature |
| to phishing         |                  | replayable       | tied to domain    |
+---------------------+------------------+------------------+-------------------+
| Exploitable secret  | Yes (password    | Yes (shared      | No (only a        |
| on server side      | hash)            | secret)          | public key)       |
| in case of a leak   |                  |                  |                   |
+---------------------+------------------+------------------+-------------------+
| Usability           | To memorize,     | Retype a code    | One gesture,      |
|                     | to type          | every time       | nothing to recall |
+---------------------+------------------+------------------+-------------------+

The reading is clear: going down the table, security and convenience increase together, which is rare. FIDO2 removes both the reusable secret on the server side and the vulnerability to phishing.

The limitations that remain

No technology is perfect. You must handle the loss of a device (hence the value of passkeys and a backup key), and deployment assumes that sites and systems support the standard, which is advancing fast.

In summary

• Hardware keys lock the private key inside a physical object; passkeys synchronize it across devices.
• Both allow passwordless login, with no reusable secret on the server side.
• Compared with the password and TOTP, FIDO2 gains both in resistance to phishing and in usability.