What is the "Password + Passkey" method for authentication?

What is the "Password + Passkey" Method for Authentication?#

The "Password + Passkey" method combines traditional password-based login with passkeys as a second authentication factor, providing enhanced security while supporting a gradual transition to passkey adoption.

User Experience#

1. The user begins by entering their password as usual.
2. After successful password entry:
   • If a passkey is available, the user is prompted to authenticate using biometrics (e.g., fingerprint or face recognition) or a PIN.
   • If no passkey is available, the user falls back to other MFA methods, such as SMS OTPs.
3. Users are encouraged to create a passkey during this process to streamline future logins.

Benefits#

• Enhanced Security: Maintains two-factor authentication with a phishing-resistant second factor.
• Ease of Transition: Allows users to continue using passwords, easing the transition to passkeys.
• Flexibility for Legacy Systems: Supports systems that cannot fully transition to passkeys immediately.

Challenges#

• Increased Steps: Users must first enter a password before using a passkey, which may introduce friction.
• Limited Passkey Functionality: Advanced passkey features like One-Tap Login or Conditional UI cannot be fully utilized when passwords are required.

Real-World Example#

Amazon implements this method, requiring a passkey as an additional step after password entry to enhance security while maintaining compatibility with existing systems.

This approach is ideal for organizations seeking a secure, stepwise integration of passkeys while maintaining familiarity for users accustomed to passwords.

Read the full article#

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →