What is a passkey, and is it really more secure than a texted code?

A passkey is a way of proving it is really you at sign-in without typing a password code. Your phone or computer holds a cryptographic key that only works with the real website, and it unlocks with whatever you already use to unlock the device: fingerprint, face, or PIN. In day-to-day use, signing in feels like a tap and a glance.

The security difference from texted codes comes down to what an attacker can steal. A texted code can be phished: a fake Microsoft login page asks for your password and then your code, and a helpful employee types both. A texted code can also be intercepted by SIM-swapping, where an attacker convinces a carrier to move your phone number to their device, or simply talked out of someone by a convincing caller. Every one of those attacks happens to small businesses, not just big ones.

A passkey defeats those plays structurally rather than by asking people to be more careful. There is no code to type, so there is nothing to hand to a fake page; the passkey simply will not respond to an impostor site. Your phone number is not involved, so SIM-swapping accomplishes nothing. And no one can read a fingerprint over the phone.

Passkeys can live in a few places depending on what suits each person: Microsoft Authenticator on a phone, Windows Hello on a PC, Apple's iCloud Keychain or Google Password Manager, or a small physical security key for shared computers and staff without smartphones. That last option matters in offices like front desks where one machine serves several people.

This shift is industry-wide, and Microsoft is now moving its business customers to passkeys by default, with texted codes retiring on a firm timeline. Our advice is to treat it as a genuine upgrade: the transition takes a few planned minutes per person, costs nothing, and closes off the exact tricks that account takeovers rely on. If sign-in security at your business still depends on six digits arriving by text, this is the year to change that on your own terms.