What is the "Password + Passkey" method for authentication?

What is the "Password + Passkey" Method for Authentication?#

The "Password + Passkey" method combines traditional password-based login with passkeys as a second authentication factor, providing enhanced security while supporting a gradual transition to passkey adoption.

User Experience#

1. The user begins by entering their password as usual.
2. After successful password entry:
   • If a passkey is available, the user is prompted to authenticate using biometrics (e.g., fingerprint or face recognition) or a PIN.
   • If no passkey is available, the user falls back to other MFA methods, such as SMS OTPs.
3. Users are encouraged to create a passkey during this process to streamline future logins.

Benefits#

• Enhanced Security: Maintains two-factor authentication with a phishing-resistant second factor.
• Ease of Transition: Allows users to continue using passwords, easing the transition to passkeys.
• Flexibility for Legacy Systems: Supports systems that cannot fully transition to passkeys immediately.

Challenges#

• Increased Steps: Users must first enter a password before using a passkey, which may introduce friction.
• Limited Passkey Functionality: Advanced passkey features like One-Tap Login or Conditional UI cannot be fully utilized when passwords are required.

Real-World Example#

Amazon implements this method, requiring a passkey as an additional step after password entry to enhance security while maintaining compatibility with existing systems.

This approach is ideal for organizations seeking a secure, stepwise integration of passkeys while maintaining familiarity for users accustomed to passwords.

Read the full article#

About Corbado

Corbado is the Authentication Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: Corbado Observe layers process mining and observability across authentication journeys. Corbado Connect adds managed passkeys with analytics built in alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →