Credentials are still one of the most useful things an attacker can get their hands on. But not every credential works the same way, and a passkey is fundamentally different from a password with better marketing.
This guide breaks down how common credential types work, how attackers abuse them, why length changes password cracking math, what multi-factor authentication (MFA) changes, and where passkeys fit.
A password and a passphrase are both secrets that a user knows. A passkey uses asymmetric cryptography instead of a reusable secret shared with the service.
A password is a reusable secret presented during authentication. The service verifies that the submitted value corresponds to the credential it has stored.
Password
--------
A reusable secret you know
Authentication:
"Prove you know the secret"A passphrase is not a different authentication technology. It is still a password, but length is usually achieved through multiple words or a longer phrase.
Passphrase
----------
A longer password made from
multiple words or a phrase
Authentication:
Still a reusable secretA passkey uses a public-private key pair. The service stores the public key. The private key remains with the user's authenticator or passkey provider and is used to prove possession.
Passkey
-------
Device / provider:
Keeps the private key
Website:
Stores the public key
Authentication:
Prove possession without
sending the private keyYou do not need a cryptography background to understand passkeys. A few plain-English terms are enough.
Encryption protects data so someone without the correct key cannot read it.
Hashing produces a fixed output from data. It is designed to be one-way, not decrypted back into the original value.
The private key stays secret. The public key can be shared and used to verify something created with the private key.
A private key can create a signature. The matching public key can verify that signature.
The website does not need the stamp. It only needs a way to recognize a valid impression from it.
Private key
-----------
Keep this secret
Think:
"Signing stamp"
Public key
----------
Safe to share
Think:
"Signature checker"
Website:
"Sign this new challenge."
Device:
Signs it with the private key
Website:
Verifies it with the public keyAdding uppercase letters, numbers, and symbols can increase the possible character set. But predictable human patterns can erase much of that benefit. Length expands the search space every time another position is added.
Summer2026!
Uppercase. Lowercase. Numbers. Symbol.
Season + Year + Symbol
Attackers do not have to begin with blind brute force. Dictionaries and password-mangling rules are designed around patterns people commonly choose.
Assume a completely random password drawn from 62 possible characters: uppercase letters, lowercase letters, and numbers.
Character set:
A-Z, a-z, 0-9
= 62 possible characters
8 characters:
62^8
= 218,340,105,584,896 possibilities
12 characters:
62^12
= 3,226,266,762,397,899,821,056 possibilitiesAt an illustrative 10 billion guesses per second against a fast offline password hash, exhausting the full 8-character space would take about 6 hours. Exhausting the 12-character space would take roughly 10,200 years.
A password policy can look strong on paper while useful credentials are still exposed elsewhere. During testing, the question is not simply whether a password meets a complexity requirement. It is whether a credential can be obtained, reused, replayed, or turned into access somewhere valuable.
Attackers care about what works, not what passed policy. A credential found in an old breach, stored in a script, reused on another system, or assigned to an overprivileged service account can matter far more than whether it contained the required symbol.
A credential exposed for one service may work somewhere else, sometimes with much greater privileges.
A small number of likely passwords can be tested across many accounts instead of hammering one account repeatedly.
Username and password pairs exposed elsewhere can be tested against another service where users reused them.
Scripts, configuration files, deployment tooling, shares, browser stores, and other systems can expose credentials without anyone guessing them.
Long-lived credentials and excessive privileges can turn one exposed service account into a much larger attack path.
Reused local administrative credentials can help turn compromise of one system into lateral movement across many.
MFA changes the consequence of a stolen password. Possession of the password alone no longer has to be enough to sign in.
We have seen this matter in real engagements. Compromised credentials that could have become a much larger organizational compromise stopped at the MFA challenge.
MFA is not magic. Sessions can be stolen, users can be socially engineered, recovery paths can be weaker than the primary login, and not every MFA method provides the same resistance to phishing. But requiring another factor materially changes the attack.
MFA and passkeys are not the same thing. MFA adds another factor to authentication. A passkey changes the underlying credential itself by replacing the reusable password secret with a cryptographic key pair.
Password managers do not change the underlying authentication model. A password is still a password. What they can change is the practical ability to maintain different, long, generated credentials without requiring a person to remember each one.
Different services can have different passwords, reducing the usefulness of one exposed password against another service.
Credentials do not need to follow memorable human patterns when the user does not have to memorize them.
The manager itself becomes an important system protecting access to many credentials. Its authentication, recovery, devices, and synchronization model matter.
Usernames, passwords, session information, and other credential data from previous compromises are routinely collected, traded, sold, and redistributed.
Some of it appears on criminal marketplaces and forums commonly described as the dark web. Some of it circulates through stealer-log services, private groups, breach collections, and eventually even public sources. If you want the plain-English version of what that ecosystem actually is, see Demystifying the Dark Web.
Attackers look there because sometimes the credentials still work. So do we. During assessments, we search for exposed information associated with the organization the same way an attacker would. When we identify relevant credentials or other exposure, we provide what we found back to the client.
2019 breach:
employee@company.com
OldPassword123!
2026:
Microsoft 365: Password changed
But...
VPN appliance: OldPassword123!
Legacy portal: OldPassword123!
Vendor account: OldPassword123!Password reuse can keep years-old breach data useful long after the original exposure.
Remember the public/private key pair from Cryptography 101? A passkey uses that same idea for authentication.
Your device or passkey provider keeps the private key. The website stores the public key. When you sign in, the website sends a fresh challenge, your authenticator signs it, and the website verifies the result.
The private key never has to be sent to the website. That is the important difference from a password.
This design makes passkeys resistant to traditional credential phishing and credential stuffing because there is no reusable password for the user to type into an impostor site.
A fingerprint, face scan, device PIN, or similar local verification method can authorize the authenticator to use the passkey. The biometric itself is not sent to the website as the credential.
Authentication does not exist in isolation. Account recovery, enrolled devices, session handling, help-desk processes, fallback authentication, and the security of the passkey provider can still matter.
A fake site cannot simply collect a passkey the way it can collect a typed password. Passkeys are bound to the legitimate service.
The relying service stores the public key, not a reusable password secret that can be recovered by cracking a password hash.
A strong primary authentication method can still be undermined if an attacker can take over the account through a weaker recovery or fallback process.
Passkeys protect the authentication ceremony. They do not make a compromised endpoint, stolen authenticated session, or vulnerable application disappear.
Passwords, passphrases, MFA, and passkeys change how identity is protected. Offensive testing asks the next question: if one control fails, what can an attacker actually do with the access?