Passkeys and passwords

A passkey is a credential kept on your device or in your password manager. You approve a sign-in with your face, fingerprint or screen lock. Nothing secret is typed, and nothing secret is sent to identity: the site receives only proof that your device holds the key. The private key never leaves your device or your password manager.

A password is a secret you know and type. Identity stores it only as a salted hash that cannot be turned back into your password, and it checks any new password against a database of known data breaches. See Security practices for the details of how.

The sign-in page puts it in two lines: a passkey Signs in with your device lock and Resists phishing.

Phishing is the commonest way accounts are taken. A password protects you only as long as you never type it into the wrong page. A passkey removes that risk, because there is nothing for you to hand over. For that reason registration lets you add a passkey while you choose the password, the sign-in offers one later, and the security checkup weighs a passkey more than any other single item.

Identity requires that you verify yourself on the device when you use a passkey, and that the passkey can be found without typing your email first. The sign-in page can offer a saved passkey in its email field. A passkey works across every TDACorp product that signs in through identity. See Passkeys.

The password is required, and it has jobs.

• The first step. Every sign-in that does not use a passkey starts with it, and an account that has none is stopped at Choose a password until it sets one. A correct password always signs you in; the platform restricts a session that looks unusual (see Continue with my password only (limited session) in The second step) instead of turning you away.
• A device that cannot make passkeys. The registration page says This browser cannot create a passkey. when the browser lacks support. The password covers that device.
• Account recovery. Recovery finishes only once the account has a password; a passkey or an authenticator app alone is not enough. When a passkey is your only second step and you lose it, your password also unlocks the Email me a code instead option.

If you keep a password, make it long and unique. The page tells you to Use a long passphrase, and says pasting from a password manager works. It shows a strength hint, which it describes as advice only: the final check is made when you save. Changing a password signs your other devices out and keeps the one you are using.

The password page lets you set or change a password, not remove it, because every account needs one. The platform also refuses to remove your only way to sign in. An account made before the password rule can still have none; the checkup then treats the password step as done, with the note No password is set, so there is none to leak., and the next sign-in asks for one.

Many password managers and platforms sync passkeys across your devices. That is convenient, and it means the passkey is only as safe as the account that syncs it. Protect that account with a strong second step too. Identity rates a passkey your keychain syncs at assurance level 2, and reserves level 3 for a hardware key whose attestation identity does not yet verify. See Security levels explained.

• Choosing a second step
• Security and passkeys