Passwords and passkeys: stop writing rules, start handing out tools

Why password rules do not work

The classic policy asks for a capital, a digit, a punctuation mark, at least twelve characters, and a new password every quarter. It reads as diligence. In practice it produces the opposite.

What happens is that people invent a pattern and stick to it, because there is no other way to remember twenty different passwords. The quarterly password becomes Summer2026! and then Autumn2026!. The mandatory change therefore yields not a new secret but a predictable series, and an attacker who knows the last one guesses the next.

The guidance was revised on this years ago. The advice now is: no mandatory periodic change, no composition rules, but do allow long passwords and do check them against lists of leaked ones. You change a password when there is cause, not because the calendar says so.

The real problem sits apart from that, and it is reuse. The same password someone uses on your business portal is also on a webshop that leaked three years ago. That leak is in a list, the list gets tried, and nobody had to crack anything.

The password manager is the first step, not the last

Reuse only disappears when remembering disappears. That is why a password manager is not a luxury for the IT department but the single highest-return measure available: everyone gets a different, long, random password everywhere without having to do anything for it.

What it solves in practice, and that is more than the vault itself:

• Shared accounts get a home. The reception account, the supplier login, the admin password for the webshop — right now those live in a chat group or on a note in a drawer. In a shared vault they sit in one place, with a list of who can reach them.
• Offboarding becomes doable. When someone leaves you can see exactly which shared passwords they knew and therefore which ones to replace. Without a vault that answer is always "we do not know, so we replace nothing".
• Phishing becomes visible. A manager only fills in on the address where it stored the password. If the user is on a lookalike page, nothing happens — and that nothing is the warning.

The pushback you get is predictable and it is about the master password: everything in one place, is that not exactly the danger? The honest answer is that you are moving a risk. You trade twenty weak, reused secrets for one strong secret with a second factor on it. That is a better trade, and it is why we recommend this rather than pretending there is no trade-off.

What a passkey is, in plain words

A passkey is not a password you no longer have to remember. It is something else, and the difference is in what travels over the wire.

With a password you send the secret to the website. The site has to receive it in order to check it, which means it can be intercepted in transit or handed to the wrong site. With a passkey your device creates a key pair. The private half stays on your device and never leaves it; the site only gets the public half. At sign-in the site sends a challenge, your device signs it, and the site verifies the signature.

From that follows the property this all turns on: a passkey is bolted to the address it was created for. A lookalike login page on an address that differs by one letter gets nothing — not because the user is paying attention, but because the browser simply does not offer the key. There is no secret you can hand over by mistake.

That is fundamentally different protection from a code out of an app. A user on a convincing fake page will simply copy that code across, and the attacker uses it within the thirty seconds it is valid. With a passkey that cannot happen.

You unlock it with your fingerprint, your face or your device PIN. Those never go to the website; they only open the key that is already there.

Where it stalls in practice

As good as the idea is, three places stubbornly strand a rollout. They rarely appear in the sales story.

• The recovery path is the weak spot. A passkey lives on a device. If that device is lost, broken, or its owner leaves, there has to be a way back. If that way is "call the helpdesk and they open your account", then that is what an attacker attacks, and you have moved the door rather than closed it. Settle how someone proves who they are before you roll out passkeys, not after.
• The fallback undoes the gain. If the password is still sitting there as an alternative, an attacker can take that route. As long as that button exists you do not really have phishing resistance. Turning it off is only possible once everyone has moved, which is exactly why a rollout needs an end date.
• Not everything joins in. Your office environment and the large cloud services support it well by now. The accounting package from your trade association, a supplier's portal and the machine on the production floor often do not. Those still need a password manager, and that is not an interim arrangement but the situation for years to come.

A fourth point comes up more often than expected: shared accounts. Passkeys are personal by design. A front-desk account used by three people fits badly, and that is usually a good moment to establish that the account should have been three accounts.

The order we keep to

All at once does not work, and starting at passkeys does not work either. This is the order in which the most risk goes first.

• One: a password manager for everyone. Including a shared vault for the accounts that belong to no single person. This removes reuse, and that is the largest single gain.
• Two: a second factor on everything, administrators first. An app or a key rather than SMS; a code by text can be intercepted and worked around.
• Three: passkeys on the accounts that matter. Start with the administrators and with sign-in to your office environment. That is what phishing aims at and therefore where the gain is largest.
• Four: close the recovery path. Who may open an account, how do they establish identity, and is it logged. Without this, step three is false comfort.
• Five: only then turn off the password fallback, group by group, and not before you are certain everyone in that group has moved.

This is the same identity layer as in Zero Trust, and it is no accident that the two subjects arrive at the same place. The account is the way in for nearly every incident, and this is the work that narrows it.

Reckon on a quarter for steps one and two at an organisation of a hundred people, and on resistance in the first fortnight. That resistance falls away once people realise they no longer have to remember anything — this is the rare subject where safer is also easier.