Passkey

A password is a secret you type, so anything that tricks you into typing it — a convincing fake login page — can steal it. A passkey works differently. Your device holds a private key that never leaves it, and it only answers the real website it was made for. A fake site gets nothing.

Signing in becomes the same motion as unlocking your phone: a face, a fingerprint or a PIN. Google, Microsoft and Apple accounts all support passkeys, and so does myGov. Services Australia makes the point directly — a myGov passkey won’t work on a fake myGov website.

Why it matters: most account takeovers still start with a stolen password. Passkeys remove the thing being stolen, and they’re quicker to use, which is rare for a security upgrade.

What to do: start with your email account — Google Workspace and Microsoft 365 both let you add a passkey in security settings. Keep two-factor authentication on as well, and keep a second way in — another device or recovery codes — in case you lose your phone.