The Passwordless Password

Passwords have been in our lives for decades. Even before technology, a spoken password might have been given to receive access to a building or social event. Since its conception, passwords were generally used for a sense of acquiring security. We used to think passwords kept us safe, but all that changed when threat actors found ways to exploit servers to gain access to sensitive information, including passwords! What was once considered secure, no longer is so. Most modern passwords are stored on a server. For example, your password for facebook, gmail, linkedln or whatever platform you prefer is, contrary to popular belief, not native to your own devices. Your passwords are stored on the platform’s web servers. Anything stored on a web server has the potential to fall victim to vulnerabilities, and ultimately, in the hands of a threat actor. But before you go freaking out, a solution has been developed for this. Let me warmly introduce you to the world of passwords successor, passkeys.

“Wait, Nick. Hold up. What are passkeys?” you might be asking yourself. I’m glad you asked because we’re about to dive down the rabbit hole. Developed by Microsoft in 2024 for its Authentication App to create a serverless password system. Microsoft Authenticator itself was created back in 2015 for authenticating passwords, but recently due to rising security issues, it has swapped to entirely Passkeys. Basically, your passwords stay on your device instead of a server. “But wait, how does Facebook know if I give it the right password or not if they themselves don’t store my password anymore?” That is another excellent question. Instead of passwords, the Authenticator app uses tokens now, or passkeys if you will. Think of Facebook as a physical club. Before, Facebook had your password displayed out in the open on a bulletin board near the bar tender. All you’d have to do upon entering is just holler at the bar tender “yo my password is password1” at the bar tender and if what you told him matches what he had on the bulletin board, the bar tender would allow you to keep access into the club. Obviously not very secure. That’s when Microsoft stepped in and said “hey, you need a bouncer that can privately authenticate club attendees before entering”. And thus, the birth of Microsoft Authenticator usage of Passkeys instead of Passwords. Microsoft Authenticator is the “Bouncer”, if you will, for logging on to your online platform. Imagine approaching the doors to the club, before entering, Microsoft Authenticator (bouncer) comes up to you and says “hey, we no longer do passwords, but I have the passkey you need to get in. If you can verify your identity with you ID (usually a pin code – that in which is stored on your local private device (no longer on servers)), I’ll let you use this temporary passkey I have so you can get in”. You show him you ID (PIN), he verifies it, whispers in your ear “tonight’s passkey is 909 764”. He allows you to enter. You walk up to the bar tender and tell him “Tonight’s temporary passkey is 909 764”. The bar tender verifies that on his bulletin board and after verifying the numbers match, he allows you to stay.

After the massive success of Microsoft Authenticator switching to Passkeys, many other major authenticator platforms have followed suit. Including, but not limited to: Google Authenticator, Apple Keychain and many others.

Passwords aren’t going away overnight, but their flaws are obvious and attackers know it. Passkeys offer a future where your identity is verified locally, never floating around the internet waiting to be stolen. It’s not just a convenience upgrade—it’s a fundamental shift in how we think about digital trust. Instead of memorizing endless logins or relying on shaky server-side protection, we move toward a world where our devices become the vault and only hand out what’s needed, when it’s needed.

Of course, no system is perfect. Passkeys will bring their own challenges: adoption, compatibility across platforms, and user education. But as more tech giants adopt this standard, the writing on the wall is clear—passwords are on their way out.

So next time you log in, ask yourself: would you rather shout your password across a crowded room, or quietly verify who you are at the door and walk in with peace of mind?