Engineering

Passkeys over passwords: shipping WebAuthn without the pain

Sam Whitaker·Principal Engineer·6 min

The password has been the weakest link in software security for decades. In 2026 the tooling around passkeys — the WebAuthn standard behind Face ID, Touch ID and Windows Hello sign-in — is finally mature enough that we reach for it by default on new builds.

Why passkeys win

A passkey is a cryptographic key pair bound to your device and a specific site. There's nothing to phish, nothing to reuse, and nothing to leak in a breach. For users it's a fingerprint or a glance; for you it removes an entire category of support tickets and attack surface.

Shipping it in practice

  • Offer passkeys as the primary option, with a fallback (email link or existing login) so nobody is locked out mid-transition.
  • Support multiple passkeys per account — people have more than one device, and lose them.
  • Handle the un-glamorous recovery paths deliberately; account recovery is where most real-world auth systems actually fail.

    • The migration path that works

    You don't rip out passwords on day one. We add passkeys alongside existing auth, nudge users to enrol at a natural moment, and let the password quietly become the legacy fallback over time. Low risk, high payoff, and a noticeably better sign-in experience — the rare security upgrade users actually thank you for.

    Ready when you are

    Let's build something that lasts.

    Book a free 30-minute call with a senior engineer. No sales pitch — just an honest view on whether we're a fit.

    Book a 30-min callSee our work