Passkeys: Password-free login as an alternative (BSI resource)

• April 19, 2026
• neelam

Behind the resource “Get Rid of Passwords?! Logging In Without a Password Using Passkey” is the German Federal Office for Information Security (BSI). BSI’s resource is aimed at consumers, businesses, organizations, and other target groups, and provides information on how passkeys work – how to use them, and how and why they came about. The goal? To explain the basics of authentication without a password and answer key questions about its use. The functions and uses of passkeys are described in a clear and easy-to-understand manner, making this resource very useful for a wide range of audiences.

Background: challenges with traditional passwords

The combination of a username and password is a well-established security measure on the internet, but it comes with its own set of challenges. Passwords must be assigned and managed individually and can be stolen in data breaches or through phishing. Against this backdrop, the BSI is introducing a technology that enables password-free login.

How passkeys work

Passkeys enable password-free login to online services. After a one-time setup in the security settings of a website or app, a secret key is stored on the device and a corresponding public key is stored with the service. These form the basis for a cryptographic process that runs automatically in the background every time you log in. When logging in, users select the passkey and confirm the login, for example, via fingerprint or facial scan. The necessary data is processed in the background, and only then is access granted.

Usage and Application

Passkeys can be used on various devices. If the passkey is stored on a smartphone, you can log in to a PC by linking the two devices, for example by scanning a QR code and providing additional confirmation.

The use of passkeys is growing. Many operating systems and online services, such as online stores, social media, and financial portals, already support this form of authentication. You can find a list of well-known services that use passkeys at passkey directory.

Dealing with Lost Devices

If devices are lost or stolen, access can be restored via backups or synchronized passkeys. Some services offer alternative identity verification methods to set up new passkeys.

Background on the technology

Passkeys are based on standards developed by the FIDO Alliance (Fast Identity Online). The FIDO Alliance develops open, vendor-neutral user authentication methods, with numerous international companies and the BSI participating in the initiative.

Additional information resources

The BSI also provides additional information resources, including the podcast “Update Available” and the newsletter “Simple • Cybersecure.” The newsletter provides regular updates on developments in cybersecurity and includes additional educational content on topics related to everyday digital life.