What is the "Password + Passkey" method for authentication?

The "Password + Passkey" method combines traditional password-based login with passkeys as a second authentication factor, providing enhanced security while supporting a gradual transition to passkey adoption.

1. The user begins by entering their password as usual.
2. After successful password entry:
   • If a passkey is available, the user is prompted to authenticate using biometrics (e.g., fingerprint or face recognition) or a PIN.
   • If no passkey is available, the user falls back to other MFA methods, such as SMS OTPs.
3. Users are encouraged to create a passkey during this process to streamline future logins.

• Enhanced Security: Maintains two-factor authentication with a phishing-resistant second factor.
• Ease of Transition: Allows users to continue using passwords, easing the transition to passkeys.
• Flexibility for Legacy Systems: Supports systems that cannot fully transition to passkeys immediately.

• Increased Steps: Users must first enter a password before using a passkey, which may introduce friction.
• Limited Passkey Functionality: Advanced passkey features like One-Tap Login or Conditional UI cannot be fully utilized when passwords are required.

Amazon implements this method, requiring a passkey as an additional step after password entry to enhance security while maintaining compatibility with existing systems.

This approach is ideal for organizations seeking a secure, stepwise integration of passkeys while maintaining familiarity for users accustomed to passwords.