Passkeys for customer logins: fewer resets, less phishing and the recovery flow you still need

Why passwords remain a problem for customer portals

Customer portals, online shops, booking systems and self-service apps still mostly rely on passwords. Customers reuse them across sites, forget them, and fall for phishing pages that imitate login screens. Businesses pay for this in support calls, password reset emails, abandoned logins and account takeover.

One-time codes by SMS or email reduce some risk, but they add friction and can themselves be phished or intercepted. For businesses that want both better security and easier logins, passkeys have become the most practical option supported across major platforms.

How passkeys work

Passkeys are based on the FIDO standards and the W3C Web Authentication specification, usually called WebAuthn. When a customer creates a passkey, their device generates a key pair. The public key is stored by the website; the private key stays with the customer, protected by the device’s biometric check, PIN or screen lock.

At login, the website sends a challenge, the device signs it with the private key after the customer unlocks it, and the website verifies the signature with the stored public key. No shared secret travels over the network or sits in the company’s database, so a database breach does not expose anything an attacker can log in with.

Each passkey is bound to the website’s domain. A phishing site on a lookalike domain cannot ask the device for the real site’s passkey, which is why passkeys resist phishing in a way passwords and one-time codes do not.

Synced and device-bound passkeys

Many passkeys are synced through the customer’s platform account or password manager, such as the credential managers built into Apple, Google and Microsoft ecosystems or third-party password managers. A passkey created on a phone can then be used on the customer’s other devices signed into the same account, which makes device replacement much less painful.

Device-bound passkeys, for example on a hardware security key, never leave that device. They suit high-assurance employee access more than general customer logins. Customers can also sign in on a device that does not hold their passkey by scanning a QR code with their phone, which uses proximity checks to confirm the phone is nearby.

Designing the rollout

Passkeys work best introduced alongside existing login methods rather than as a forced switch. Common entry points are offering to create a passkey right after a successful password login, during account creation, or after a password reset when the customer is already thinking about access.

Plain language

Explain that customers will sign in with the same fingerprint, face or screen lock they use to unlock their device, and that the biometric data does not leave the device.

Autofill

Support conditional mediation so passkeys appear in the browser’s autofill suggestions on the login field.

Multiple passkeys

Let customers register more than one passkey and see, name and remove them in account settings.

Fallbacks

Keep a secure alternative for customers on unsupported devices or who decline, and review whether the fallback is weaker than it should be.

Account recovery is the real security boundary

A login method is only as strong as the way customers get back into an account when they lose access. If recovery is a simple email link or an SMS code, attackers target recovery instead of the passkey. Recovery design therefore deserves as much attention as the login screen.

Options depend on the risk of the service. Synced passkeys reduce recovery needs because they survive device loss. Additional passkeys on other devices provide a backup. For higher-risk services, recovery can involve identity verification, a waiting period with notifications to existing contact details, or support staff checks. Whatever the method, customers should be notified when passkeys are added or removed.

Technical considerations

Implementation involves registration and authentication endpoints, storage of public keys and credential identifiers per user, and verification of signatures and challenges on the server. Well-maintained libraries exist for common programming languages and identity platforms, and many customer identity services support passkeys directly.

The relying party identifier must be chosen carefully, because passkeys are bound to it. Companies with several domains or country sites need to plan which domain the passkeys belong to. Mobile apps need association files linking the app and the website so the same passkeys work in both.

Measure the results: share of logins using passkeys, login success rates, time to sign in, password reset volumes and support tickets. These numbers make the business case clearer than security arguments alone.

Where passkeys fit with regulation

Passkeys can support stronger authentication, but regulated services must still meet their own rules. Payment services in the EU, for example, have strong customer authentication requirements with specific conditions on factors and dynamic linking for payments. Healthcare, financial and public services may have assurance requirements that determine how passkeys are combined with identity verification.

In those contexts, passkey design should be reviewed against the applicable requirements rather than assumed to satisfy them automatically. For most customer portals, shops and booking systems, passkeys are simply a safer and easier login.

Where this sits in what we do

This article covers one decision inside a wider engagement. The solution page sets out how that engagement runs, what it includes and what it costs to find out.

• Custom Business Platform — A platform built around how your business actually runs — customer portal, internal tooling, database and the automation between them.
• Quote to cash without re-keying: where the handoffs break
• Product data is the e-commerce growth lever nobody budgets for
• Password policies that match current guidance: length, breached-password checks and no forced expiry
• Pharmaceutical logistics: turning Good Distribution Practice into customer visibility
• All insight articles