You have probably seen a button that says "Sign in with a passkey". It is the biggest change to logging in in years, and it is easier to use than it sounds.
What a passkey is
A passkey is a pair of cryptographic keys made for one website. The public key is given to the website. The private key never leaves your device or password manager. To sign in, the site sends a challenge, your device proves it holds the private key (after you confirm with a fingerprint, face or PIN), and you are in. There is no password to type, steal or reuse.
Why passkeys are safer
- They cannot be phished. A passkey only works for the exact website it was created for, so a lookalike site gets nothing.
- They cannot be guessed or reused. Every site gets its own key pair.
- A breached website leaks nothing useful. It only holds public keys.
Where passkeys live
A passkey can be stored on your phone or computer, in your browser's account, or in a password manager. Keeping them in a password manager means they sync between your devices and browsers, and are not tied to one phone or one company. The trade-off is that the manager's own lock matters even more, so use a long master password.
How NettForge handles passkeys
With a Personal plan or above, the NettForge extension acts as a passkey provider: it creates a passkey when a site asks, stores it encrypted inside the login's entry in your vault, and asks for your approval in NettForge's own window before using it. If you would rather use a different passkey, such as one on your phone, that option stays available.
What to do now
- Turn on passkeys for your email, banking and shopping accounts where the site offers them.
- Keep your password as a backup until you are comfortable.
- Protect the place the passkeys live: a long, unique master password for your vault, and 2FA on your accounts. See how to make a strong password.
Read how NettForge keeps everything private in what is a zero-knowledge password manager, or see which plan includes passkeys.
Questions people ask
Not yet. Many websites still need a password, and some only support passkeys as an option. For now you will use both, which is why a manager that holds passwords and passkeys together is useful.
For most people, yes. A passkey cannot be guessed, reused or typed into a fake website, because it only works with the real site it was made for. You still need to protect the device or vault that holds it.
Yes, on Personal plans and above. The NettForge browser extension can create and use passkeys, which are stored encrypted in your vault entry like everything else. You can always choose to use another passkey instead.