Risky password habits can have big consequences, and some companies are making it easier to stay secure online by ditching decades-old password methods and implementing passkeys instead. Microsoft intends to do the same starting in August.
Whether you have an easy-to-guess password or it’s leaked in a company data breach, if hackers get hold of it, it can open the door to identity theft and fraud. A recent CNET survey found that 49% of US adults have risky password habits, like using the same password for multiple accounts and even using personal information, like your name, as a part of your password.
If you use Microsoft Authenticator to store your passwords, here’s what you need to know about the transition and how to set up passkeys before the deadline.
Microsoft Authenticator won’t support passwords after August
Currently, Microsoft Authenticator houses all of your passwords and lets you sign into all of your Microsoft accounts using a PIN, facial recognition, such as Windows Hello, or other biometric data, like a fingerprint. Authenticator can be used in other ways, such as verifying that you’re logging in if you forgot your password, or using two-factor authentication as an extra layer of security for your Microsoft accounts.
How you use the app will change starting this month, according to Microsoft:
- June 2025 – Microsoft said you’ll no longer be able to add passwords to the Authenticator app.
- July 2025 – You won’t be able to use the autofill password function.
- Aug. 2025 – You’ll no longer be able to use saved passwords.
If you still want to use passwords instead of passkeys, you can store them in Microsoft Edge. But CNET experts recommend adopting passkeys during this transition.
“Passkeys use public key cryptography to authenticate users, rather than relying on users themselves creating their own (often weak or reused) passwords to access their online accounts,” said Attila Tomaschek, CNET software senior writer and digital security expert.
Why passkeys are a better alternative to passwords
So what exactly is a passkey?
It’s a credential created by the Fast Identity Online Alliance that uses biometric data or a PIN to verify your identity and access your account. Think about using your fingerprint or Face ID to log into your account. That’s generally safer than using a password that is easy to guess or susceptible to a phishing attack.
“Passwords can be cracked, whereas passkeys need both the public and the locally stored private key to authenticate users, which can help mitigate risks like falling victim to phishing and brute-force or credential-stuffing attacks,” Tomaschek added.
Passkeys aren’t stored on servers like passwords. Instead, they’re stored only on your personal device. More conveniently, this takes the guesswork out of remembering your passwords and the need for a password manager.
How to set up a passkey in Microsoft Authenticator
Microsoft said in a May 1 blog post that it will automatically detect the best passkey to set up and make that your default sign-in option.
“If you have a password and ‘one-time code’ set up on your account, we’ll prompt you to sign in with your one-time code instead of your password. After you’re signed in, you’ll be prompted to enroll a passkey. Then the next time you sign in, you’ll be prompted to sign in with your passkey,” according to the blog post.
To set up a new passkey, open your Authenticator app on your phone. Tap on your account and select “Set up a passkey.” You’ll be prompted to log in with your existing credentials. After you’re logged in, you can set up the passkey.
Read the full article here