FIDO2 and WebAuthn passkeys resist classic credential phishing by binding authentication to the service’s domain. They do not eliminate every password or risks involving devices and recovery accounts. Singapore’s Cyber Security Agency published its passwordless-authentication guide on August 26 and updated it on September 18, 2026; it distinguishes phishing-resistant passkeys from other “passwordless” methods such as magic links and SMS codes, which are not phishing-resistant.
Authentication is changing, but risk is not disappearing
On August 26, 2026, Singapore’s Cyber Security Agency published guidance on passwordless authentication. Its message is clear: passwords remain a prime target for phishing, credential stuffing, and data breaches, so organisations should gradually adopt more resistant mechanisms.
Passkeys, FIDO2 security keys, and some Windows Hello implementations can replace password entry with a cryptographic proof tied to a device. This is an important change. It does not mean that access management, device security, and sensitive data become safe automatically.
What is passwordless authentication?
With traditional authentication, a service checks a shared secret: your password. If that secret is stolen, reused, or entered on a fake website, an attacker can often sign in.
With a passkey, the service stores a public key while the credential provider protects the private key. Depending on the type of passkey, it can be bound to one device or synced in protected form across devices with the same provider. In September 2026, Google also announced secure passkey transfers between managers on Android. During a WebAuthn sign-in, the private key is not sent to the website: the user locally authorizes its use with a PIN, fingerprint, or face recognition, depending on the device.
This architecture makes a phishing page far less useful. The browser checks the expected domain before using the key, so a fake domain cannot simply collect the same secret as it could with a password or copied code.
For a separate risk model, read our analysis of synced passkeys in Google Password Manager.
Three practical benefits for businesses
1. Fewer reusable secrets
Reused passwords are especially dangerous. A breach at one service can open the door to other accounts. Passwordless authentication reduces reliance on secrets that users remember and reuse across services.
2. Stronger phishing resistance
Not every passwordless method offers the same protection. FIDO- and WebAuthn-based mechanisms provide the strongest phishing resistance because authentication is bound to the legitimate domain. SMS codes and approval prompts that users can accept without checking remain more exposed.
3. A simpler user experience
A biometric gesture or local PIN can be faster than entering a complex password. Simplicity also makes it more likely that security policies will be followed in daily work.
What passwordless does not solve
Passwordless authentication mainly protects access to a service. It does not automatically protect every piece of information stored on devices or inside applications.
The device becomes critical
If a computer or phone is compromised, an attacker may try to hijack an open session, install spyware, or access other local data. Updates, disk encryption, automatic locking, and privilege separation remain essential.
Recovery accounts remain sensitive
Losing a device may trigger a recovery process. A backup email address, phone number, recovery code, and provider account must therefore be protected as carefully as the primary account.
Passwords have not disappeared yet
Many services do not support passkeys yet. Teams still need to manage credentials for legacy applications, service accounts, emergency access, and some offline environments.
To organise those remaining credentials, use our password manager security audit guide.
A realistic five-step strategy
- Start with critical accounts: email, administration, VPN, file storage, and billing.
- Enable phishing-resistant authentication when a service supports FIDO2 or WebAuthn.
- Keep controlled recovery methods and test them before an emergency.
- Reduce privileges and regularly review authorised devices and sessions.
- Store remaining credentials in an encrypted vault available locally and controlled by the organisation.
Where Soclyde fits
Passkeys secure the relationship between a user, a device, and a service. Soclyde addresses accounts that still use passwords: its encrypted vault stays on the user’s devices, without a centralized cloud vault operated by Soclyde.
For a business, these choices complement each other: passkeys protect sign-ins to services that support them, while still-needed credentials stay in a local-first vault. This does not protect a compromised device or replace access controls and secure recovery accounts. To organise remaining credentials, read our SMB password policy guide.
Key takeaways
Use FIDO2/WebAuthn passkeys first for critical accounts when the service supports them. Also secure devices and recovery methods, then protect any remaining passwords with unique secrets and controlled storage.
