Passwords, Passkeys, and the Way Back In

A password manager helps people create and store different passwords for different services. That matters because one reused password can become a path into several accounts. For systems that still require passwords, use long, unique values and a manager. Do not make people invent frequent cosmetic changes or complex patterns that push them toward sticky notes and reuse.

A passkey is a sign-in credential tied to a device or account and a specific website. It is bound to the real site’s identity, so under normal operation it cannot be presented to a lookalike site; a person can type a password or one-time code into one. The National Institute of Standards and Technology (NIST) published SP 800-63B-4, part of its updated Digital Identity Guidelines, in July 2025. It classifies passwords and manually entered one-time codes as not phishing-resistant. That is a specific technical category, not a ban: NIST still permits these methods at appropriate assurance levels. Strong passwords and second factors still protect services that lack passkeys. Enrollment and recovery matter whichever method you choose.

An attacker may prefer “I lost my phone” to guessing a password. Ask how a new sign-in method is registered, how the help desk verifies identity, and who can reset an administrator. Require a second set of eyes for high-impact recovery and alert the account owner when sign-in methods change. Test recovery with a safe account before anyone is stranded.

Give administrators separate accounts for administrative work. Limit how many people have broad rights, and review accounts nobody uses. An assistant should never inherit a shared human login merely because it is convenient. If a tool needs its own account, give it an owner, limited access, and a clear way to turn that access off.

Track the share of active users on stronger sign-in, failed and suspicious sign-ins, recovery time, and accounts still using a shared credential. Ask staff where sign-in makes normal work harder. A secure method that fails on a warehouse tablet or a shared front desk needs a workable alternative, not a quiet exception.

Start with administrators and systems holding sensitive data, then extend by role. If the business cannot recover a critical account without an unsafe workaround, fix that before declaring the rollout complete.