Can passkeys be hacked?
Short answer
Passkeys provide strong defense against common account takeover methods, but your accounts can still be compromised if underlying devices or recovery channels are breached. As guidance from CISA highlights, multi-factor authentication and phishing-resistant authenticators significantly reduce the likelihood of account compromise compared to passwords alone. However, an unauthorized user can still gain access if they compromise your unlocked device or breach linked recovery services.
The details
The FIDO Alliance provides passkeys for passwordless authentication. A passkey replaces traditional passwords, which can be guessed, reused across sites, or stolen through phishing. In contrast, CISA notes that multi-factor authentication, including phishing-resistant methods, makes it significantly harder for threat actors to access accounts even if credentials are exposed. By removing shared passwords from authentication workflows, passkeys help eliminate the risk of password reuse and credential harvesting.
A common mistake is assuming that passkeys eliminate every security risk. A practical decision rule is to treat your authentication security as only as strong as the physical devices and recovery accounts protecting it. Regardless of authentication method, protecting the device that stores your credentials remains critical. If an attacker gains access to an unlocked phone or an associated primary email account, your security posture is degraded. The NCSC recommends installing device software updates promptly and securing primary email accounts with strong credentials.
What to do
- Turn on passkeys or multi-factor authentication on financial, email, and social media accounts.
- Protect your phone, computer, and tablet with a PIN, password, or biometric lock.
- Install the latest operating system and application updates as recommended by security agencies.
- Protect your primary email account with a strong, separate password and secondary verification.
Useful next reads and tools
Terms explained
- Account takeover
- Account takeover is when a criminal gains control of someone else’s online account, usually with a stolen or reused password, a phished one-time code or a hijacked session.
- HTTPS and TLS
- HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
- Passkey
- A passkey is a phishing-resistant sign-in credential based on public-key cryptography, stored on a device or in a password manager and unlocked with a biometric or device PIN.
- Patch management
- Patch management is the process of finding, prioritizing, testing and installing software updates that fix security flaws.
- Phishing
- Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.