Identity
Why Passwords Are Becoming Obsolete: How Passkeys Aim to Stop Data Breaches
Passwords are now seen as a major security risk. Passkeys, a new login method, promise to make stolen database logins useless to hackers. Here’s how they work and what to watch out for.
Ross Grant3 min read
The short version
Passwords are easy to forget and often get stolen in data breaches. Passkeys are a new way to log in that ties your account to your device, making stolen logins useless to hackers. Experts say passkeys are much safer, but you still need to protect your device from malware.
What happened?
PCMag reports that using passwords in 2026 is now considered a major security risk. Passkeys, a new login method, are being adopted by more services to replace passwords. Experts say passkeys make database hacks less useful to criminals, but warn that attackers can still steal browser cookies to bypass security. Only PCMag has reported this so far, and there is no confirmation from primary sources.
Passwords: The Weak Link in Online Security
For decades, passwords have been the main way we log in to websites and apps. But passwords come with big problems. People often reuse them or choose weak ones. Even if you use a password manager, the password itself still sits on a company’s server. If that server is hacked, your password can be stolen or sold on the dark web. This is why data breaches keep making headlines, and why experts now say passwords are a massive risk.PCMag (opens in a new tab)
What Are Passkeys and How Do They Work?
Passkeys are a new way to log in that does not use a password at all. Instead, your account is linked to something you own, like your phone or computer. When you set up a passkey, the website stores a public key (a kind of digital lock), while your device keeps a private key (the only key that fits the lock). When you log in, your device proves it has the private key without sending it over the internet. If you use Apple devices, your private key might be stored in your iCloud keychain. This system is based on standards from the FIDO Alliance, a group that works on secure online authentication.
Passkeys have several advantages:
- They cannot be guessed or reused.
- They are unique to each website, so they won’t work on fake sites (helping stop phishing).
- They are not stored on company servers, so hackers cannot steal them in a data breach.
The Limits: Cookie Theft and Other Risks
Passkeys are not a silver bullet. Trevor Hilligoss, a security researcher at SpyCloud, told PCMag that even with passkeys, attackers can still target other weak spots. One example is browser cookies. When you log in, websites often use cookies (small files stored in your browser) to remember you. If malware infects your device, it can steal these cookies and let attackers bypass even strong login methods. So, while passkeys make database hacks much less useful to criminals, website owners and users still need to protect against malware and cookie theft.PCMag (opens in a new tab)
What Should Users and Website Owners Do?
For users, switching to passkeys where possible is a strong step forward. Check if your bank, email, or favourite apps offer passkey login. Keep your devices secure with updates and antivirus tools to reduce the risk of malware. For website owners, supporting passkeys is important, but so is protecting session cookies and patching other vulnerabilities.
The Road Ahead: Are Passwords Really Going Away?
Passkeys are spreading, but not every service supports them yet. Adoption will take time, and passwords may stick around for a while. Still, the trend is clear: moving away from passwords could make stolen databases much less valuable to criminals. But as always in security, no single fix solves everything. Layered defences and user awareness remain key.
Claimed vs confirmed
- Unconfirmed
Passwords are now a massive risk and are being replaced by passkeys.
Reported by PCMag, but not confirmed by primary sources or vendors.
- Confirmed
Passkeys cannot be stolen in a database hack.
This is a property of passkey technology as explained by PCMag and security experts.
- Confirmed
Attackers can still bypass passkeys by stealing browser cookies via malware.
Security researcher Trevor Hilligoss told PCMag that cookie theft remains a risk even with passkeys.
The impact
- Money
- No direct financial figures are given, but widespread data breaches can lead to large fines under GDPR (up to £17.5m or 4% of annual turnover in the UK). Passkeys could reduce these risks by making stolen databases less valuable.
- Reputation
- Companies that move to passkeys may be seen as more secure, but failing to protect against cookie theft or malware could still damage trust if accounts are compromised.
- Customers
- Customers who use passkeys are less likely to have their accounts stolen in a data breach, but should still protect their devices from malware and be aware of session cookie risks.
Why it matters
Anyone who uses passwords online is at risk if a company’s server is hacked. Passkeys make it much harder for criminals to use stolen login details. But users and website owners must still guard against malware and cookie theft.
How does it work?
Passkeys use public key cryptography. The website stores a public key, while your device holds a private key. When you log in, your device proves it has the private key without sending it, so even if a company’s server is hacked, your login cannot be stolen. Passkeys are unique to each site and cannot be reused or phished.
Key points
- Passwords stored on servers are a major security risk.
- Passkeys link logins to your device, not a password.
- Passkeys cannot be stolen in a database breach.
- Attackers may still target browser cookies via malware.
- Switching to passkeys and securing devices is recommended.
