Every year, Verizon publishes the Data Breach Investigations Report, the closest thing the security industry has to a definitive account of how breaches actually happen. In the 2026 edition, something changed for the first time in the report’s 19-year history: exploiting a software vulnerability overtook stolen credentials as the single most common way attackers get in.
That’s genuinely good context, not a reason to stop caring about passwords. Credentials still showed up as compromised data in 28% of all breaches. They’re still the single most common thing stolen in web application attacks specifically. And most tellingly: 73% of ransomware victims had a credential leak or infostealer infection somewhere in the year before the attack hit. Stolen logins didn’t stop being a problem. They just stopped being the only headline problem.
Passkeys exist because of that specific, still-massive slice of the picture: the part where someone’s login itself gets stolen, guessed, or phished.
What a Passkey Actually Is
A passkey isn’t a longer password or a fancier code. It’s a completely different mechanism. Instead of you typing something a server checks against a stored value, your device generates a cryptographic key pair. One half stays locked to your device (protected by Face ID, Touch ID, Windows Hello, or a hardware key like a YubiKey). The other half sits on the server. Logging in means proving you hold the private half, without ever transmitting anything a thief could steal and reuse.
There’s nothing to type. Nothing to phish out of you over email. Nothing sitting in a database that becomes useful to an attacker if it ever leaks, because the server side of a passkey is useless without the physical device it’s paired with.
Why This Beats a Typed 2FA Code
Two-factor authentication with a typed code (the classic 6-digit app-generated number) is a real, meaningful improvement over a password alone. It’s also not immune to being phished.
Here’s the specific attack that works against typed codes and doesn’t work against passkeys: a fake login page, built to look identical to the real one, captures your password and your 2FA code the moment you type them, then relays both to the real site in real time, fast enough to log in before your code expires. Tools that automate exactly this exist and are genuinely used. The code being time-limited doesn’t help if it gets relayed within that window.
A passkey can’t be phished this way, because it isn’t a piece of information you type that could be captured and replayed. It’s cryptographically bound to the actual domain you’re logging into. A fake site, no matter how convincing it looks to you, simply isn’t the real domain, and your device won’t offer the passkey to it at all. The browser checks that before you ever get a chance to be fooled.
What This Looks Like in Practice
On a WordPress site with proper passkey support, logging in looks like this: click login, your device prompts for Face ID or a fingerprint or your device PIN, you’re in. No password field to fill, no app to open, no code to squint at and type before it expires.
It’s faster than a password for the person logging in, and it closes off an entire category of attack for the site owner. That combination, easier and more secure, is rare enough in security that it’s worth taking seriously when it shows up.
The Honest Limits
Passkeys solve the credential-theft slice of the problem specifically. They don’t do anything about the vulnerability-exploitation slice that Verizon’s report shows is now the bigger single entry point. A passkey won’t patch an outdated plugin, and it won’t stop an attacker who’s already found a different way in through vulnerable code. It’s one genuinely strong piece of a real defense, not the whole thing.
That’s exactly why login security should sit alongside things like file integrity monitoring and vulnerability scanning, not instead of them.
Setting This Up on WordPress
Most WordPress sites still only offer a password, sometimes with a typed 2FA code bolted on as a separate plugin. Native passkey support, built into the same plugin as everything else rather than requiring a second install, is still genuinely uncommon in this space.
SecondGate includes passkeys in the free tier: Face ID, Touch ID, Windows Hello, or a hardware key, alongside standard TOTP as a fallback for anyone without a passkey-capable device. No typed codes required if you don’t want them.
