Why We Support Passkeys for Signing In
Passwords have been the default way to sign in for decades, and they have been a security problem for just as long. People reuse them, forget them, write them down and type them into convincing fake websites. Even strong passwords can be stolen in a breach of some other service.
Passkeys are a newer approach supported by modern browsers and operating systems, and our platform supports them for signing in. Here is why we think they are worth offering, and what people should know about them.
What a passkey is
A passkey is a pair of cryptographic keys created for one website. The private key stays on your device, protected by its lock screen. The public key is stored by the website. When you sign in, the website sends a challenge, your device signs it with the private key after you unlock it with your fingerprint, face or device PIN, and the website checks the signature with the public key.
You never type a secret. The website never stores one.
Why passkeys resist phishing
A fake sign-in page can trick someone into typing a password. It cannot trick a passkey. Passkeys are bound to the real website's address, so a device will not use the passkey on a look-alike domain. That single property removes the most common way accounts are stolen.
Nothing useful to steal from our servers
With passwords, a website stores a protected version of every user's password. If that data were ever exposed, attackers might try to crack it. With passkeys, the website stores only public keys, which cannot be used to sign in. There is no shared secret on our side to lose.
User verification is built in
Most passkey sign-ins require the person to unlock their device, which combines something they have, the device, with something they are or know, a fingerprint, face or PIN. That is why our platform does not add a separate two-factor code after a passkey sign-in: the protection is already part of the step. Every other sign-in path, by contrast, hands off to the two-factor challenge for people who have it turned on, which we explain in two-factor sign-in on every path.
Faster for people, too
Security features often add friction. Passkeys usually remove it. Signing in becomes a single touch or glance instead of remembering and typing a password, then finding a code. For administrators who sign in many times a day, that adds up.
What people should know before switching
Passkeys are not magic, and a few practical points help:
- Keep a recovery route. If you only have a passkey on one phone and lose it, you need another way in. Set up a passkey on a second device or keep your password and recovery codes until you are comfortable.
- Synced passkeys follow your account. Many phones and computers sync passkeys through the platform's own account, so a new device can use them. That convenience depends on keeping that account secure.
- Shared computers need care. Do not create passkeys on a computer other people use.
- Your device lock matters. A passkey is as strong as the lock screen protecting it. Use a PIN, fingerprint or face, not a simple swipe.
Offering choice, not forcing it
We support passkeys alongside passwords with two-factor authentication. Different people and organizations are at different points in their security journey, and forcing a change before people are ready tends to create support problems and workarounds. Offering a better option and explaining it clearly is how we encourage adoption.
Part of a layered approach
Passkeys are one layer in how we protect accounts, together with two-factor checks on every path, server-side permission checks and careful handling of secrets. If you want to manage your own passwords better in the meantime, our free, local password manager Jag Pass is one of the products on our Technology & Impact page.
Frequently asked questions
Are passkeys safer than passwords?
Generally yes. Passkeys resist phishing, cannot be reused across sites and leave no shared secret on the website's servers to steal.
What happens if I lose the device with my passkey?
You can sign in with another device that has a synced passkey, or with your password and two-factor recovery options if you kept them.
Do passkeys work on every device?
Most current phones, computers and browsers support passkeys. Older devices may not, which is one reason passwords remain available.
Related Posts
Using AI Moderation as a Signal, Not a Judge
AI can spot harmful content quickly, but it also makes mistakes. Here is how we use moderation results to alert people, and where narrow automatic action is justified.
Consent First: How We Handle Email and Text Message Permissions
Sending messages people did not ask for damages trust and breaks rules. Here is how our platform treats consent, unsubscribes and suppression as features, not fine print.
Accessible Forms: Labels, Errors and Focus
Forms are where people sign up, pay, register and ask for help. Here is how we make them clear and usable for everyone, including people using screen readers or keyboards.
Every AI Call Is Registered Before It Runs
AI features cost money and touch customer data, so we keep a registry of every one. Here is how a call that is not on the list is refused before anything is spent.
Build, Reuse or Buy: How We Decide
Every new capability raises the same question: build it ourselves, reuse something we already have or rely on a provider. Here is the reasoning we use.
Comments (0)
No comments yet. Be the first to share your thoughts!