Passkeys: How Password-Free Login Works and When to Add It

Think of the last time a customer could not log in to your portal. They forgot the password, waited for a reset email, and perhaps gave up. A passkey removes that whole chain. The customer signs in by unlocking their phone or laptop in the usual way, with a fingerprint, a face scan or the screen PIN, and nothing is typed or remembered.

How a passkey works, in plain words

When a customer creates a passkey, their device generates a pair of digital keys. The public half goes to your website, which stores it. The private half never leaves the device. At login, your site sends a random challenge, the device signs it after the customer unlocks it, and your site checks the signature against the public key.

MDN explains that this standard is called WebAuthn and that the signature is bound to your site's address. That is why a fake lookalike site cannot steal a login, and why a leaked database of public keys is of no use to a thief. There is no shared secret to guess, reuse or phish. MDN lists WebAuthn as Widely available, working across browsers since September 2021, and it requires a secure HTTPS connection.

Who supports it, and how common it is

The FIDO Alliance, the industry group behind the standard, published its State of Passkeys 2026 report on 7 May 2026. It cites 5 billion passkeys in active use. In its survey of 11,000 consumers across 10 countries, including India, 90 percent were familiar with passkeys and 75 percent had enabled them on at least some accounts. Remember that this is an industry body's own survey, and a survey of people who regularly log in online, so it will overstate how common passkeys are among your particular customers.

The browser side is mature enough to build on. Web.dev lists the base passkey interface in Chrome 67, Edge 18, Firefox 60 and Safari 13, with newer helper features in more recent versions.

What the login screen should feel like

Good passkey design is mostly about not surprising people:

• One sign-in box. Web.dev describes a pattern where saved passkeys appear in the browser's autofill list on the username field, so customers do not choose a method first.
• A gentle offer after a normal login. Suggest creating a passkey once, in words such as "Sign in faster next time", and do not repeat the nag on every visit.
• A password fallback. Customers with old phones, shared computers or a lost device still need a way in.
• Clear recovery. Decide in advance what happens when someone replaces their phone, and test that path.
• No extra step after a passkey. Web.dev notes that passkeys resist phishing, so asking for a second code afterwards defeats the point.

Where OTP still belongs in India

Many Indian customers verify a mobile number with a one-time password, and your business may need that number for delivery, invoices or WhatsApp updates. A passkey proves a person is using their enrolled device. It does not prove that the phone number they typed is real or reachable. So keep OTP verification at sign-up and for sensitive changes, such as a new delivery number. Payment authentication by banks and gateways follows its own rules, so do not assume a passkey replaces those steps. Your payment provider can confirm what is required.

Also note that two-factor authentication can still make sense for admin users with powerful access, using a method suited to them.

When it is worth adding, and when it is not

Passkeys pay off for sites where customers log in often: student portals, member areas, dealer ordering systems, booking accounts and staff dashboards. They matter less for a brochure site, or for a shop where most buyers check out as guests once. The extra build effort is real, because the server must store keys, handle recovery and test across devices. For a simple site, a well-built OTP login is still a respectable choice.

A common middle path is to launch with phone OTP and add passkeys as an optional upgrade for returning users, which keeps risk low and lets you watch whether people actually choose it.

Questions to ask your developer

1. Will passkeys be offered as an addition, with password or OTP kept as a fallback?
2. What happens when a customer changes phones?
3. Are we using a tested library or login service, not custom cryptography?
4. Has the flow been tried on Android, iPhone and a shared Windows computer?
5. What will we measure, such as login success rate and reset requests?

VS Tech Builders builds customer accounts for web portals and SaaS applications with these questions answered during design. If you want to know whether passkeys suit your login flow, tell us how your customers sign in today.

Sources

Checked on 3 November 2026. Technology changes quickly; always confirm details with the official source before you act on them.

• The State of Passkeys 2026: Global Consumer and Workforce Report — FIDO Alliance
• Web Authentication API — MDN Web Docs
• Sign in with a passkey through form autofill — web.dev

Frequently asked questions

What is a passkey?

A passkey is a password replacement stored on your device. You sign in by unlocking the device with a fingerprint, face scan or screen PIN. Behind the scenes a pair of keys is used: the website keeps the public one and the private one never leaves your device, so there is no password to forget or steal.

Are passkeys safer than passwords?

Generally yes. MDN explains that the login is tied to the site's real address, so fake sites cannot capture it, and a stolen database holds only public keys. There is no password to reuse or guess. Safety still depends on the device lock and a sensible recovery process, so test those carefully.

Can passkeys replace OTP for Indian customers?

Not entirely. A passkey proves the customer is using their enrolled device, but it does not verify that a phone number belongs to them. Keep OTP for sign-up, number changes and anything your business needs to confirm. Payment authentication follows rules set by banks and gateways, so check with your payment provider.

Is it worth adding passkeys to a small business website?

Only if customers log in regularly, as in member areas, student portals or dealer ordering. For brochure sites and guest checkouts it adds effort with little gain. A reliable OTP login is enough for many small businesses, and passkeys can be added later as an optional upgrade.