What Are Passkeys and How Does Passwordless Authentication Work?

You type your password into what looks like your company sign-in page. An attacker sitting between you and the real site copies it in real time, grabs your one-time code, and signs in as you. The Canadian Centre for Cyber Security studied more than 100 of these campaigns against Microsoft accounts, and Canada supplied 77 percent of the business email compromise victims. The password is the weak link, and passkeys remove it.

A passkey replaces your password with a pair of cryptographic keys. You prove who you are with a fingerprint, a face scan, or a device PIN, and no secret ever travels to the website. Phishing stops working, because there is no password to steal and no code to replay. Here is how passkeys work, what Canadian guidance says, and how to roll them out without leaving a back door open.

What a Passkey Is

When you create a passkey, your device generates two linked keys. The private key stays on your phone, laptop, or hardware token and never leaves it. The website keeps the matching public key. To sign in, your device uses the private key to answer a challenge, and the site confirms the answer with its public key. You approve each login with a biometric or a PIN, so losing the device alone does not hand over your account.

Passkeys build on the web authentication standard browsers and websites use to talk to authenticators. Some passkeys sync across your devices through a password manager. Others stay bound to one device, like a security key you carry.

Why Passkeys Beat Passwords and One-Time Codes

Passwords fail in predictable ways. People reuse them, attackers guess them, and credential stuffing tools replay stolen ones across hundreds of sites. Even multi-factor authentication built on text messages or app codes falls to an adversary-in-the-middle attack, where a proxy page relays everything you type to the real site and captures the session.

A passkey closes both gaps. No shared secret reaches the server, so a breach of the website exposes only a public key, useless to an attacker on its own. The private key never appears on a fake page, so a phishing site collects nothing. The Cyber Centre calls this a phishing-resistant authentication mechanism, and points to passkeys and FIDO2 security keys as its leading examples.

What the Numbers Say

The attacks have changed, which raises the stakes. The Cyber Centre analyzed more than 100 campaigns against Microsoft Entra ID accounts between 2023 and early 2025. Proxy-based adversary-in-the-middle attacks went from zero percent of detected campaigns in early 2024 to 88 percent by June 2025. Business email compromise drove roughly 91 percent of the activity, and Canada supplied 77 percent of the victims.

Canadians are ready for the alternative. In Payments Canada research, half of Canadians found passkeys appealing, and 47 percent said they would use them for email, banking, or online shopping.

Canadian Guidance Worth Following

The Canadian Centre for Cyber Security published direct advice in its April 2026 note, Cyber security considerations for passkeys (ITSAP.30.033). It explains how passkeys work, names them a phishing-resistant option, and lists the risks worth planning for. For teams fighting account takeover, the companion guidance on phishing-resistant multi-factor authentication (ITSM.30.031) tells you to deploy it to every user, apply it to all administrator accounts, and strip out weaker backup methods an attacker would target instead.

Federal departments already operate under ITSG-33, whose identification and authentication controls require strong, verified sign-in for sensitive systems. Smaller organizations get a practical baseline from the CCCS Baseline Cyber Security Controls, which ranks strong authentication among the first steps for any small or medium organization. Reference these Canadian sources first. NIST and ISO 27001 align with them as the international backup.

The Risks You Still Manage

Passkeys remove the password problem, not every problem. The biggest residual risk sits in fallback logins. When a system keeps passwords or email codes as a backup, an attacker takes the weaker path, and your passkey protects nothing. Close those routes for high-value accounts. A synced passkey is also only as safe as the cloud account holding it, so a weak password manager login undoes the benefit. Older devices often lack secure key storage, and every device needs regular patching. CCCS tells you to plan for the quantum threat and keep your cryptography agile as well.

How to Roll Out Passkeys

Start where the damage runs highest. Turn on passkeys for administrators, finance staff, and anyone with access to customer data, then widen the rollout from there. Remove or restrict password fallbacks for those accounts so no weak alternative remains. Pair the rollout with the conditional access rules the Cyber Centre recommends, such as limiting sign-ins to registered devices or known IP ranges. Test the flows your staff rely on before you cut over, and give people a clear recovery path for a lost device, one which does not reopen the password door you worked to close.

Build the Skills to Deploy It Right

Passwordless sign-in works when the people behind it understand identity, web security, and monitoring. Mile2 trains those roles. The Certified Information Systems Security Officer develops the identity and access governance a security leader needs to set authentication policy and answer to auditors. The Certified Secure Web Application Engineer teaches developers to build and verify authentication the right way, so a passkey integration holds up under attack. The Certified Cybersecurity Analyst sharpens the monitoring skills to spot the account-takeover attempts passkeys are meant to stop.

Passwords have failed for years, and attackers know every trick to steal them. Passkeys take the secret off the table. Move your high-value accounts first, close the fallback paths, and follow the CCCS guidance written for Canadian organizations. You turn your weakest control into your strongest one.