Please, please, please stop using passkeys for encrypting user data

2026-02-27 · Source: Simon Willison's Weblog · Field: Technology & Digital — Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Intermediate, quick

Summary

Tim Cappalli, writing on February 27, 2026, urges the identity industry to cease using passkeys for encrypting user data. He emphasizes that users frequently lose their passkeys and often do not comprehend that their data, once encrypted with a lost passkey, becomes permanently unrecoverable. Cappalli advocates for passkeys to be exclusively utilized as phishing-resistant authentication credentials, highlighting their effectiveness in that specific role. The core message is a plea to prevent irreversible data loss scenarios stemming from the misuse of passkeys for encryption rather than their intended purpose of authentication.

Key takeaway

For CTOs and VPs of Engineering evaluating identity management strategies, you should strictly limit passkey usage to authentication. Do not implement passkeys for encrypting user data, as this creates an unacceptable risk of irreversible data loss when users inevitably misplace their passkeys. Focus on leveraging passkeys for their intended benefit: robust, phishing-resistant user authentication.

Key insights

Passkeys should be used for phishing-resistant authentication, not for encrypting user data due to recovery risks.

Principles

• Passkeys are for authentication.
• Lost passkeys mean lost data.

In practice

• Implement passkeys for authentication.
• Avoid passkeys for data encryption.

Topics

• Passkeys
• User Data Encryption
• Authentication Credentials
• Data Recovery
• Phishing Resistance

Best for: CTO, VP of Engineering/Data, Security Engineer, Software Engineer, Product Manager

Related on AIssential

• The Dumbest Reason Systems Get Compromised Is Still Default Passwords — Default credentials remain a critical vulnerability due to enterprise scale, necessitating automated, comprehensive testing.
• Take Control: Customer-Managed Keys for Lakebase Postgres — Lakebase CMK offers comprehensive, customer-controlled encryption for both storage and ephemeral compute via hierarchical Envelope Encryption.
• A hotel check-in system left a million passports and driver’s licenses open for anyone to see — Basic cybersecurity misconfigurations, not sophisticated attacks, frequently cause significant data exposure incidents.
• Google API Keys Weren't Secrets. But then Gemini Changed the Rules. — Shared API key infrastructure between public and private services creates critical privilege escalation risks.
• Introducing Advanced Account Security — OpenAI's Advanced Account Security enhances ChatGPT and Codex protection through phishing-resistant authentication and stricter recovery.
• scan-for-secrets 0.1.1 — Version 0.1.1 of the "scan-for-secrets" tool was released on April 5th, 2026, designed to identify secrets within files intended for sharing.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Simon Willison's Weblog.