Passkeys & Security Keys for Staff
Last verified: October 2026
Passkeys and security keys are sign-ins that can't be phished — bound to the real website, so a fake login page captures nothing reusable. Here's how to roll them out to a handful of staff without lockouts. Rather have a hand? My number is (330) 200-8042.
Passkeys and Security Keys, at a Glance
A second step at sign-in stops most break-ins — but texted and app codes can still be phished, because a fake login page can ask you to type them in. Passkeys (FIDO2/WebAuthn) and hardware security keys close that trick: they're bound to the real website, so a fake page captures nothing reusable. A passkey lives on a device you already own — your phone or computer, unlocked with a fingerprint or face — while a security key is a small physical device you plug in or tap. This guide shows how to roll them out to a handful of staff, starting with the accounts that matter most, with a backup for everyone so nobody gets locked out. There's a printable 29-page version up top.
Common Questions
1 What makes passkeys and keys 'phishing-resistant'?
They're tied to the real website and only answer to it. On a fake login page there's no password or code to hand over and nothing a crook could carry back to the genuine site. The trick that beats ordinary codes — getting you to type them into a fake page — simply doesn't work.
2 What's the difference between a passkey and a security key?
A passkey lives on a device you already own (phone or computer) and you unlock it with a fingerprint, face, or PIN — usually free. A security key is a small physical device you plug in or tap, ideal for your most important accounts. Both are phishing-resistant.
3 Are they really stronger than the codes I use now?
Yes. Codes are far better than a password alone but can still be phished. Google has reported that hardware security keys blocked roughly 100% of automated bots, about 99% of bulk phishing, and around 90% of targeted attacks in its testing — a big step up from a texted code.
4 What if someone loses their key or phone?
That's why everyone gets a backup — a second passkey or spare key — plus a recovery path. You remove the lost one from the account so it can't be used, switch to the backup, and set up a fresh backup. An inconvenience, not a crisis.
5 Who should get them first?
Your most powerful and exposed accounts: the Microsoft 365 Global Administrator or Google Workspace super-admin, the owner, and anyone who moves money or handles sensitive records. Protect the keys to the kingdom first, then expand as time and budget allow.
6 Do these work with Microsoft 365 and Google Workspace?
Yes — both let you add passkeys and security keys as a strong sign-in method. Menu names move, so check your current admin center. Our guides on locking down Microsoft 365 and Google Workspace cover turning on and enforcing the second step for everyone.
Would You Rather I Just Help?
Rolling out passkeys and security keys is exactly the kind of friendly, high-value job I love — an afternoon and your most important accounts simply can't be phished, with nothing to sell you (I don't sell any brand of key). I'll pick the right mix, enroll everyone with a backup so nobody gets locked out, and lock down your admins first. $99 flat for a visit, 30-day come-back-free. I'm a tech helper — just honest advice.
Would you rather I just do this for you?
No shame in it — plenty of folks would rather hand it off, and that's what I'm here for. I'll come to your home, set it up right, and make sure it's working before I leave. Flat $99 per visit — no jargon, no upsell, and every visit is 30-day come-back-free.
Not a hardware job? I can often fix it remotely for $49 — a secure screen-share, up to 2 hours, that you watch the whole time and can end whenever (included free for $39/mo Support Plan members, and it counts toward the $99 if it turns out I need to come out).