Passkeys aim to replace the passwords you keep reusing

Twilio, the communications company, says passkeys are gaining ground as a way to log in without a password. Its reasoning is simple: people reuse passwords, and criminals know it. The company says up to 51% of passwords are reused. For anyone who still uses one favorite password across many accounts, that is the number to notice.

The trouble with passwords

Twilio says weak passwords are tied to over 80% of data breaches. A 2024 study by HYPR found that 69% of companies were breached through their login processes in the twelve months before the report. Passwords also cost money. Nearly 30% of help desk costs are password related, mainly because people forget them. They can be guessed or cracked, and they are open to phishing, where a scammer tricks you into handing over your login.

What passkeys are

Twilio describes a passkey as a passwordless method that ends reliance on the same credentials used again and again. Passwordless methods in general replace something you remember with something you own or have. The part of the article provided here does not explain how passkeys work in detail.

Other ways to log in

• Token-based login uses a device such as a phone, laptop or smart card, and can stay verified for a set time, such as 24 hours.
• Certificate-based login uses digital certificates. Governments have used it for decades, but it can be costly and slow to set up.
• Two-factor and multifactor login add extra steps. None are immune to hackers, and they can add friction.
• Text message codes, a single-use code sent by SMS, have been the go-to method for decades.

What is not clear yet

The article comes from Twilio, which sells a tool called Twilio Verify for passwordless business logins. The text available cuts off before it compares passkeys directly with the other methods. It gives no verdict on which is best, what switching costs, or how long a move would take.

What to do

Business owners can ask their login or security provider whether passkeys are available. Everyone else can start by checking for reused passwords, since that habit is the risk Twilio points to most.