> ## Content Index > Fetch the complete content index at: https://signal.happychases.com/llms.txt > Use this file to discover other available public pages before exploring further. # Passwords are dying. What replaces them? - URL: https://signal.happychases.com/passwords-are-dying-what-replaces-them/ - Published: 2026-10-06T06:00:00.000Z - Updated: 2026-10-06T06:00:00.000Z - Description: Security engineer Priyanka Nair explains passkeys in plain English: how they work, why they're much harder to phish, and what still needs to be fixed before everyone can stop typing passwords. - Author: Maya Chen - Tags: Security, Interviews, #Import 2026-11-03 19:38 Passwords are dying. What replaces them? 0:00 /2760 1× For as long as most of us have been online, passwords have been the front door to our digital lives. They are also, by almost every measure, a terrible system. We reuse them. We forget them. We type them into convincing fake websites. And every few months, another company announces that millions of them have been stolen. Priyanka Nair is a security engineer who has spent the last few years helping organisations move away from passwords entirely. In this episode she explains passkeys — the technology many large platforms are now promoting as the password's replacement — in language that doesn't require a computer science degree. ## In this episode - **00:00** — Why passwords were always a bad idea - **07:10** — Phishing, explained in two minutes - **13:25** — What a passkey actually is - **22:40** — Why passkeys are much harder to phish - **30:15** — Syncing, lost phones and account recovery - **38:20** — The awkward bits that still need fixing - **43:50** — What listeners should do this week ## What is a passkey? Priyanka's explanation goes roughly like this. A passkey is built on public-key cryptography, using open standards developed by the FIDO Alliance and the W3C, including one called WebAuthn. When you create a passkey for a website, your device generates a pair of linked keys. The public key is stored by the website. The private key stays on your device, protected by its lock — your fingerprint, face or PIN. When you sign in, the website sends a challenge. Your device signs it with the private key, after you unlock it. The website checks the signature using the public key. At no point does anything secret travel over the internet, and there is no password for anyone to steal from the website's database. > "The best secret is the one that never leaves your pocket." ## Why phishing gets much harder The part of the episode Maya found most striking is about phishing. With a password, a fake website that looks exactly like your bank can trick you into typing your credentials. With a passkey, that trick largely stops working, because each passkey is tied to the specific website it was created for. Your device simply won't offer it to a look-alike domain. "It takes the human out of the hardest part of the decision," Priyanka says. "You don't have to spot the fake. Your device does it for you." 🎧 **This episode is free for everyone**, because we think it's genuinely useful. If it helped, consider [supporting Signal](#/portal/signup) so we can keep making episodes like it. ## The awkward bits Priyanka is candid that passkeys are not yet perfect. Some of the challenges she discusses: - **Switching ecosystems.** Moving passkeys between different platforms has historically been clumsy, though it has been improving. - **Shared accounts.** Families and small teams who share logins need clear, simple ways to share passkeys safely. - **Account recovery.** If you lose every device, how do you prove who you are? Recovery is often where security systems are weakest. - **Confusing language.** Different services describe passkeys in different ways, which makes people hesitant to use them. None of these are reasons to avoid passkeys, she argues — only reasons for the industry to keep improving them. ## What to do this week Priyanka's practical advice for listeners: 1. Turn on passkeys for your most important accounts where they're offered — email first, since it's usually the key to resetting everything else. 2. Use a reputable password manager for any accounts that still need passwords. 3. Make sure you have at least one recovery method set up and up to date. 4. Be suspicious of any message that urgently asks you to sign in through a link. ## Key takeaways - **Passwords fail in predictable ways.** People reuse them, forget them and type them into convincing fake sites — and companies keep leaking them. - **Passkeys use public-key cryptography.** The public key lives with the website; the private key stays on your device, unlocked by your fingerprint, face or PIN. - **Nothing secret crosses the internet.** Signing in means your device answers a challenge, so there's no password in a database waiting to be stolen. - **Phishing gets much harder.** Each passkey is tied to the site that created it, so your device won't offer it to a look-alike domain. - **It isn't finished yet.** Moving between ecosystems, sharing accounts and recovering from lost devices still need work across the industry. - **Start with email.** It's usually the key to resetting every other account, so it's the most valuable place to switch on a passkey first. - **Keep a password manager** for everything that hasn't moved to passkeys, and make sure your recovery options are up to date. ## Transcript excerpt **Maya:** Will my parents be able to use this? **Priyanka:** Honestly, I think it'll be easier for them than passwords. They already unlock their phones with their face. That's the whole experience. The hard part is on our side — making the setup and recovery just as simple. ## Mentioned in this episode - The FIDO Alliance and the W3C WebAuthn standard - Public-key cryptography, explained simply - Password managers and account recovery ## About our guest Priyanka Nair is a security engineer who specialises in authentication and identity. She has helped organisations of all sizes, from small charities to large retailers, reduce their reliance on passwords and strengthen account recovery. She speaks regularly at security meetups and is known for explaining complicated cryptography with kitchen analogies. She has not used the same password twice since she was a teenager, and admits this is mostly because she can't remember any of them. ## Credits Signal is hosted by Maya Chen and Daniel Osei. This episode is general information, not security advice for any specific situation.