Suneet Singal on passkeys and passwords

Suneet Singal’s blog has a dated post on passkeys and passwords, and this entry is the reference version of the distinction rather than a rewrite of that post. A password is a shared secret you and a site both know, or that the site stores in a form it can check. A passkey is a cryptographic credential: the site stores a public key, and the private key stays with your device or your platform’s credential manager. You unlock the device. You do not type the private key into the page. This page explains that difference, where passwords remain, and why the topic is not the same project as post-quantum planning. It does not say the password era has ended. It does not give instructions for breaking into an account. It is not personal security advice about Suneet Singal’s own logins, which are not described here.

A password is a shared secret

A password works because both sides can check the same secret. You remember it or a manager stores it. The site stores something that lets it verify what you send. If another person learns the secret, that person can send it too, from anywhere the site allows a login. The secret is not bound to one browser tab in the way a passkey is bound to a site. It can be reused, and reuse is how a leak at one site becomes a login at another. It can be typed into a page that only looks like the site you meant. Those are properties of a shared secret. They are the reason guidance about passwords talks about length, uniqueness, and a manager.

The Cybersecurity and Infrastructure Security Agency publishes a page on using strong passwords. That page is the checklist to follow for any password you still have. This entry will not freeze a paraphrase in place of it. Length rules and manager advice can be updated on the official page, and the official page should win. What will not go stale as a concept is the job description: a password is something you present, and anyone who can present it can be you, as far as the site’s password check is concerned. Extra factors, such as a code or a prompt, exist because that job description is weak on its own. CISA’s page is where a reader sees how the agency currently wants those pieces combined.

A password manager does not change the nature of the secret. It changes how many secrets you can stand to keep, and it can prevent you from typing a long unique password into the wrong window if you use it carefully. It is a tool around the shared-secret model. It is not a passkey. Calling the manager a passkey because it fills the box automatically mixes two designs. The manager may also store passkeys, depending on the product. Storage is not the definition. The definition is whether you are handing over a secret or proving possession of a private key.

A passkey is a key pair tied to a site

The FIDO Alliance’s passkeys page describes the model this entry is summarizing. A passkey is a FIDO credential. The website holds a public key for your account. The private key is held by an authenticator: a device, or a platform credential manager that can sync the credential according to that platform’s design. When you sign in, the site issues a challenge, and the authenticator signs it with the private key after you unlock the device with the gesture, PIN, or biometric the device already uses. The biometric, if there is one, is checked on the device. It is not a password you type into the website, and it is not sent to the website as the secret.

The credential is created for a particular site, the relying party. A lookalike site does not receive a reusable password it can replay, because you did not type a reusable password, and because the credential is bound to the real site’s identity. That is the phishing resistance people mean when they recommend passkeys. This page stops at that description. It does not explain how a lookalike site is built, how a person is lured there, or how to test a site’s defenses. The defensive point is enough: the thing that used to be typed, and stolen by being typed, is no longer the thing being sent.

Platforms differ on whether a passkey stays on one device or syncs through an account you already have with the platform vendor. Synced passkeys are easier when you replace a phone, and they make that platform account part of the security story. Device-bound passkeys stay put, and losing the device matters more. The FIDO page and the platform’s own documentation are the sources for which behavior you actually have. This entry will not assign a sync policy to a vendor from memory. Policies change. Read the page that matches the device in your hand, and write down the date.

Passwords have not left the building

Many sites still offer only a password. Many sites offer a passkey and keep the password as a fallback. A fallback password that is weak, reused, or still accepted from anywhere will be the path someone uses, and the passkey will sit unused beside it. Turning on a passkey without asking what the password fallback still allows is an incomplete change. Ask whether the password can be removed, whether it can be restricted, and what the account-recovery path is if the passkey is unavailable. Recovery that emails a reset link to an inbox protected by a reused password has moved the shared secret one step sideways. It has not retired it.

CISA’s password guidance remains relevant for exactly these leftovers. Unique, long passwords, stored in a manager, for the sites that still demand them, plus the multi-factor options the site and CISA’s current page actually support. A passkey rollout in a household or a company is a census of leftovers as much as it is a celebration of the new credential. The cryptographic-inventory entry is where that census can live as rows: site, method, whether a password fallback remains, who can reset it, and when the row was last checked.

There is no basis on this page for announcing that the password era has ended. The blog post titled “Passkeys vs Passwords: Is the Password Era Finally Ending?”, at https://blog.suneetsingal.net/2026/10/05/passkeys-vs-passwords-is-the-password-era-finally-ending/ , asks a question in its title and answers it in its own text, on its own date. This reference does not copy that text. A reader can observe, without any article, that password forms are still common. That observation is enough to keep the CISA page on the desk next to the FIDO page. One is for the credentials you are moving toward. The other is for the secrets you still have.

Recovery and the device

The hard part of passkeys is not the sign-in on a calm day. It is the lost phone, the new computer, the locked platform account, and the shared family device. Before you depend on a passkey for an important account, read the recovery steps the site and the platform publish, and try to say them back in one sentence. If the sentence is “I would be locked out,” the passkey is not yet a complete plan, even though the cryptography is fine. Add the recovery the provider actually offers, which may be another device, a synced platform login, or a one-time code you are told to store. A one-time code is a secret again. Store it the way CISA would have you store any other high-value secret, not in an unlocked note titled passwords.

Unlocking the device is part of the system. A short device PIN undercuts the passkey that depends on it. The biometric is convenient and is only as good as the device’s own protection and the fallback PIN. This page does not set a PIN length. The device vendor and CISA’s current guidance are the places to read that. The conceptual point is that a passkey shifts some of the risk from “a secret typed into a website” to “control of the device and of the platform account that holds the credential.” That shift is an improvement against phishing. It is not a reason to leave the device unlocked.

Shared computers and shared tablets need an explicit decision. A passkey saved in a browser profile that several people use is a credential those people can invoke. A password written on a card beside that computer was at least visibly shared. The passkey can be shared by accident because it is invisible. Before you create one on a machine you do not solely control, read where it will be stored. If the answer is the shared profile, choose a different profile or skip the passkey until you have a device boundary you understand.

This is not a post-quantum project

Passkeys and post-quantum planning both use the word cryptography, and they are different projects. Passkeys replace a typed secret with a public-key login, which addresses theft and phishing of passwords with tools available now. Post-quantum planning asks which public-key methods would fail to protect long-lived secrets if a sufficiently capable quantum computer existed, and it points at the NIST standards finalized in August 2024: FIPS 203, FIPS 204, and FIPS 205. A household that creates a passkey has not completed a post-quantum inventory. An organization that begins that inventory has not, by doing so, turned off its passwords.

The algorithms inside today’s passkeys are themselves public-key algorithms, and a later inventory should record them rather than assume they are outside the question. This page will not name a required curve or a required hash, because deployments differ and the FIDO specifications are the authority. The planning sentence is modest. When you inventory authentication, write “passkey” only together with the platform and the date, and leave a column for the algorithm if the documentation states it. The post-quantum entry explains why the column exists. The CISA post-quantum initiative and the NIST project page are the sources for that program. They are not instructions for choosing a phone.

Mixing the two projects produces bad priorities. Someone told that “quantum is coming” may ignore phishing this year. Someone told that “passkeys solved security” may ignore long-lived encrypted archives. The vocabulary on this site keeps the projects in separate entries so a reader can do both readings without collapsing them. Related reading includes the preserved article at /post-quantum-security-is-no-longer-a-future-problem/ , which has its own publication date and is not a passkey tutorial. Check that date before treating a sentence in it as a current instruction. The editorial standards page says why.

A small inventory of sign-in methods

List the accounts that matter: mail, banking, the password manager itself, the platform account that syncs passkeys, work login, and the domain registrar or website host if you have one. For each, write the method you use today. Password only. Password plus a second factor. Passkey, and whether a password still works. Then write the recovery path in a few words. Then write the date you checked. That is an authentication inventory. It is not a full cryptographic inventory, which also includes encryption of stored data, certificates, and signatures. It is the identity slice, and it is the slice a person can often fill without asking a vendor for a white paper.

Do not put the passwords themselves in the same note as the inventory if the note will be emailed, backed up in the clear, or pasted into a chat. The inventory can say “unique, in the manager” without repeating the secret. The manager is the store. The note is the map. Confusing the map with the store is how a careful inventory becomes a new leak. CISA’s warning against reusing passwords is also a warning against collecting them in a document that is less protected than the manager.

Companies have the same slice at a larger scale: which workforce accounts allow passwords, which require a phishing-resistant method, which vendors hold the identity platform, and who can reset a user. This essay does not supply a policy template. It supplies the questions a policy has to answer. A real estate or finance organization reading Suneet Singal’s site is in the same position as any other reader here. The professional background explains the site’s interest in careful categories. It does not imply a particular firm’s login has been redesigned.

What to do with the official pages

Read the FIDO Alliance passkeys page for the model, then read the help page for the platform you actually use, because the model and the menu labels are not the same text. Read CISA’s use-strong-passwords page for the passwords that remain, and follow that page if it is more specific than this one. Read the NIST post-quantum project page only to keep the boundary clear, not because a passkey setting lives there. When a blog post, including the one on Suneet Singal’s blog, makes a broader claim about the end of passwords, read its date and then look at the sites you personally still sign in to. The sites are the test. The headline is the headline.

This reference will not walk through a vendor’s screens. Screens change, and a screenshot essay becomes wrong quietly. It will not tell you to disable a control you need for recovery, and it will not tell you that any particular account is safe. Safety is a property of the whole arrangement: the credential, the fallback, the device, and the recovery. The arrangement is yours to check against the official pages. Suneet Singal’s entry is finished when those pages are open and the shared secret has been distinguished from the key pair. The clicking is deliberate work, done in your own accounts, and it is not performed by reading.

What this entry does not claim

Suneet Singal’s published professional background is in real estate and corporate finance. Company filings linked from this site record a chief executive officer departure from FC Global Realty Incorporated effective 2 January 2018 and an acting chief executive officer appointment at First Capital Investment Corporation effective 12 September 2017. The Suneet Singal Scholarship, Grant and Giving websites describe him as the founder of those programs. This entry explains a general subject. It is not a private track record, a current job title, an investment result, or a quote.

Continue with a cryptographic inventory, post-quantum planning in plain language, and why an article’s date is part of its meaning.