Passkeys vs password sharing: what actually changes?
The passkey promise
Passkeys are cryptographic credentials tied to a specific device and user, designed to replace passwords entirely. Instead of a string of characters you type in, authentication happens via biometric verification (face ID, fingerprint) on your device, which generates a cryptographic signature proving your identity. The private key never leaves your device. There is no password to steal, no password to phish, and — critically — no password to share.
Major platforms including Apple, Google, Microsoft, and hundreds of consumer services have adopted passkeys. The W3C WebAuthn standard underpinning them is mature and widely supported.
So does password sharing become obsolete?
For individual consumer accounts, passkeys are a significant improvement. If you log into your personal banking app with a passkey, there is no credential to share, because the credential is cryptographically bound to your device and your biometric. Even if someone wanted to share access, they couldn't hand over a passkey the way they'd hand over a password.
But this does not eliminate the credential sharing problem in professional and organisational contexts. Here's why.
Where passkeys don't help (yet)
Shared accounts Many organisational systems rely on shared accounts — a single login used by multiple team members. Passkeys are currently designed around individual authentication. A passkey belongs to one device and one user. A shared account with a passkey is, at the moment, technically awkward or impossible on most platforms.
System-to-system credentials API keys, database connection strings, service account credentials — these are machine-to-machine secrets, not user authentication. Passkeys are designed for human authentication flows and have no bearing on these credentials.
Legacy systems A vast amount of software — internal tools, older SaaS platforms, custom-built systems — will continue to use passwords for years or decades. Passkey adoption is accelerating, but the transition is measured in years, not months.
Credential handover scenarios Even with passkeys, there will be situations where someone needs to hand over account access. A departing employee needs to transfer admin access to a successor. A contractor needs to be given temporary access to a client system. These handovers require some form of credential transfer, whether that's a password, a temporary passkey, or a recovery mechanism.
Recovery codes: the new sharing challenge
One side effect of passkey adoption is that recovery codes become more important. When your primary authentication is device-based, a recovery code is what you use if you lose the device. These recovery codes function exactly like passwords — they're sensitive, they need to be stored somewhere, and sometimes they need to be shared. The credential sharing problem doesn't disappear; it shifts.
The practical outlook
For the foreseeable future, organisations will be managing a mix of passkey-enabled services and traditional password-protected systems. The practices and tools for secure credential sharing remain fully relevant. As passkeys become more prevalent, the volume of password sharing may decrease — but the need for secure handling of credentials that must be transferred will persist.
PassTransfer handles any text secret — not just passwords. Recovery codes, API keys, temporary credentials, and any other sensitive string can be shared via a one-time encrypted link. As the authentication landscape evolves, the core problem — getting a secret securely from one person to another — doesn't go away.
Conclusion
Passkeys are a genuine improvement in authentication security and will reduce the need for password sharing in consumer contexts over time. In professional and organisational contexts, credential sharing remains a necessary and security-sensitive activity for the foreseeable future. The tools and practices for handling it securely are as relevant as ever.
