The end of passwords: WebAuthn and passkeys explained

Introduction

How many passwords do you juggle every day? Between business applications, customer portals, collaboration tools and personal services, the sprawl of credentials has become a nightmare for users… and for the IT teams responsible for keeping them secure. Despite years of awareness campaigns, habits remain poor: reused passwords, passwords that are too simple, stored in unencrypted files or on sticky notes around the office.

For an IT director, a mid-sized company or an MSP, this model has reached its limits: ever more complex password rules degrade the user experience without addressing the structural causes of compromise. Rather than trying to “save” the password, the challenge now is to organize its gradual phase-out in favor of inherently stronger mechanisms: WebAuthn and passkeys.

Why passwords are a problem

Numerous security studies show that most account breaches involve compromised credentials (theft, phishing, database leaks, brute-force attacks or credential stuffing). The problem is structural: a password is a shared secret. To authenticate, the user must send that secret (or something derived from it) to the server, which creates just as many potential points of attack: interception, keylogging, compromise of the password database, and so on.

Even very strict policies are not enough. When you require 16 characters, symbols, frequent renewal and a ban on reuse, many users end up:

• reusing the same base password with a few predictable variations;
• writing it down in unsecured files;
• or falling back on easy-to-guess patterns.

In the end, the system is “stronger” in theory, but more fragile in practice and more costly for IT teams to run.

Common mistakes with passwords and MFA

Two mistakes come up often in organizations:

• Over-investing in password complexity. Energy goes into fine-tuning the policy (length, characters, rotation) rather than reducing reliance on the password itself.
• Rolling out MFA without thinking about the user journey. Poorly designed MFA (SMS, clunky OTPs, uncovered edge cases) ends up being seen as friction, or even bypassed day to day, which undermines both security and employee buy-in.

For an IT director or an MSP, this means rising support tickets, workarounds, and an uneven security posture that is hard to explain to the business.

How passkeys work

WebAuthn is a W3C standard that relies on asymmetric cryptography for authentication. Here is how it works:

• During registration, the user’s device generates a key pair:
  • a private key, stored securely on the device or in a hardware authenticator (FIDO2 key, secure module, secure enclave, TPM, etc.);
  • a public key, sent to the service and linked to the user’s account.
• During authentication, the service sends a challenge. The authenticator signs this challenge with the private key, and the service verifies the signature using the known public key.

Two major consequences:

• The private secret never leaves the user’s device: no password or reusable secret travels over the network or is stored on the service side.
• Authentication is bound to the domain (origin binding): a phishing page that imitates the site but lacks the right domain cannot exploit the passkey.

For the user, a passkey often comes down to a simple gesture: unlocking their device (fingerprint, Face ID, local PIN) or using a security key they physically own.

Why this is a paradigm shift

Passkeys make it possible to:

• eliminate password entry for users on compatible services;
• defeat many phishing attacks aimed at capturing credentials;
• reduce reliance on secrets users have to memorize, while improving the experience and speed of sign-in.

For an IT director, this means fewer “forgot password” tickets, a smaller attack surface and a gradual move toward passwordless authentication.

Rolling out passkeys in the enterprise

For a company or an MSP, the question is not only technical, but also organizational and gradual. A pragmatic approach can follow these main steps:

1. Map your applications.
   • Identify the applications compatible with WebAuthn/FIDO2 (first: SaaS, internet-facing portals, critical applications).
   • Prioritize those that concentrate the most risk (admin access, sensitive data, partner access).
2. Build on your Identity Provider.
   • Enable the WebAuthn/FIDO2 scenarios offered by the major identity providers (for example Entra ID/Azure AD, Okta, etc.).
   • Define access conditions (Conditional Access) and the target passwordless scenarios (corporate PCs, BYOD, FIDO2 keys, etc.).
3. Define an authenticator policy.
   • Clarify which types of authenticators are accepted: hardware security keys, synced passkeys (Apple/Google/Microsoft ecosystems), platform authenticators.
   • Take use cases into account: remote work, mobility, contractors, subcontractors, remote access, etc.
4. Set up recovery mechanisms.
   • Scenarios for a lost device or key: a second passkey, a backup key, IT support, assisted enrollment procedures.
   • Clear documentation for users and level 1 support.
5. Run a pilot.
   • Start with a limited, high-value group (IT team, management, administrators, critical business roles) to validate the journeys and fine-tune the processes.
   • Measure adoption, incidents and user perception before extending to the whole organization, or to the whole client portfolio for an MSP.

What about oversight for IT directors, mid-sized companies and MSPs?

Beyond the purely technical side, moving to passkeys becomes a matter of IT management: visibility, roadmap and governance. This is where a platform like IT-OneView comes into its own for IT directors, mid-sized companies and MSPs.

In the transition to passkeys, IT-OneView can help in particular to:

• Connect authentication methods to employees.
  • See, for each employee and each company or subsidiary, the assets and critical services they access.
  • Cross-reference this information with the authentication policies defined in your identity tools (for example, identify the groups still 100% reliant on passwords).
• Document and standardize onboarding/offboarding.
  • Standardize joiner and leaver checklists (account creation, enrollment in the new authentication methods, access revocation).
  • Track how these processes are carried out to limit orphaned accounts and residual access.
• Prepare for and simplify audits.
  • Get a consolidated view of the estate, the employees and the security policies applied, useful for recurring audits (internal, client, regulatory).
  • Show, with evidence, how authentication has been modernized over time (from passwords to passkeys).

For an MSP, this approach is replicated client by client, with the ability to compare maturity and prioritize actions where the risk is highest.

Tooling up for passkeys

Deploying passkeys relies on several building blocks:

• Identity providers (IdP).
  • Entra ID/Azure AD, Okta and other IdPs support WebAuthn/FIDO2 and provide the passwordless scenarios, conditional access rules and usage reports you need.
• Authenticators and ecosystems.
  • FIDO2 security keys, platform authenticators (PCs, smartphones), passkeys synced through the major vendors’ clouds.
• Oversight and visibility tools.
  • A platform like IT-OneView to connect these building blocks to the real context: employees, assets, costs, risks and audits, with cross-functional governance in mind.

Conclusion

Passkeys are the most significant evolution in authentication since passwords first appeared in modern information systems. They address the structural weaknesses of traditional credentials while making life simpler for users, a rare lever where security and experience converge.

For an IT director, a mid-sized company or an MSP, the question is no longer whether this transition will happen, but how to manage it: which scopes to start with, how to standardize enrollment and recovery processes, and how to prove progress over time. By combining the capabilities of modern IdPs, FIDO2/WebAuthn authenticators and an oversight platform like IT-OneView, it becomes possible to organize the gradual end of the password… without losing operational control of your IT.