Last month I wrote about logging into Joomla with passkeys, and I ended it by asking you to drop a comment if there was appetite for more. Well, you did, and the comments turned out to be better than the article. You asked exactly the right questions: how do I roll this out to my users, what happens if I lose my phone, what if my machine has no fingerprint reader, and, from at least one healthy sceptic, is this whole thing actually ready or is it a bit of a mess out there?

So this is the follow-up I promised in the thread. I am going to work through your questions more or less one at a time, and I am going to name names, because you did the hard work of asking. Let us get into it.

Passwords started in ancient times but the first one for a digital platform was 1961 at MIT. I came along in 1965 and today I am using them less and less, pushing clients and myself to passwordless solutions. Children born today may have “whats a password?” added to the list of things that are consigned to the museum; I for one hope so.

So now on to the readers section and lets see if we can accelerate their decline.

The one everybody asked for: rolling passkeys out to real users

Richard Williams, who has been building on Joomla since a 2020 lockdown project and now looks after his local bowling club's site, asked how best to roll passkeys out to the people already using a site. Steven Harker is in the same boat, and made a lovely point: for his users, dropping the need to type a username at all will be the thing that really drives adoption. Both of you are right that this is the real question. Turning passkeys on is easy; bringing your users with you is the actual job.

Here is how I would go about it.

Offer it, do not force it. This is the golden rule, and it answers a worry John Beech raised too, so hold that thought. Leave normal password login switched on. Add passkeys alongside it, as an option. On your Joomla login screen the passkey button simply sits next to the usual username and password box. Nobody who is not ready is pushed anywhere.

Go in phases. Start with yourself and your admins. Get comfortable, iron out the wrinkles on your own accounts, and make sure recovery works (much more on that below, because it matters). Then invite your keenest, most confident users. Then, once you have a bit of a track record, everyone else.

Write them a two-minute how-to. Most people have never deliberately created a passkey, even though their phone has been nudging them to for a year. A short, friendly page, "log in as normal, go to your profile, click Add New Passkey, follow the prompt", removes almost all the fear.

And here is my favourite trick: build your administrators a Guided Tour. Joomla's Guided Tours, which I have written about before, let you build a step-by-step walkthrough straight into the administrator interface. And that admin focus, far from being a limitation here, is rather the whole point. The accounts you most need to protect are the ones holding the keys to everything: your Super Users, Administrators and Managers. If a front-end member of your bowling club loses their login it is a nuisance; if a Super User's login is phished, the entire site is in trouble, because that is the login that can change templates, install extensions and read every record you hold. Those high-value people all work in the Joomla backend, which is exactly where a Guided Tour lives. So you build the tour once and it walks each of your admins through creating their passkey, in the real interface, at their own pace, with no screen-share and no support call. For your front-end-only members you would pair it with a short written how-to instead, but for the accounts that matter most, this is precisely what Guided Tours were made for.

And to save you building that tour yourself, I have made one and put it up as a small, free plugin. Install it and a Set up your passkey tour appears under Users, Guided Tours; run it and it takes an administrator from the control panel, to their own account, to a saved passkey, then nudges them to add a second one as a spare. It is self-contained: uninstall the plugin and the tour vanishes again, leaving nothing behind, and it works on Joomla 5 and 6. You can download it from https://update.softforge.co.uk/joomla/extensions/plg_passkeytour/plg_system_passkeytour-1.0.0.zip and install it the usual way, through Extensions, Install. Consider it my small contribution to getting us all onto passkeys a little faster.

On Steven's point about dropping the username: that is genuinely where Joomla is heading. Once browser support is universal, the plan sketched out in Nicholas Dionysopoulos's original issue is to let you log in with nothing but your passkey, no username at all, and eventually to switch off password login entirely for an account. Slicker and safer, both at once.

"What if I lose my phone?" Recovery, honestly

Chris asked the question that keeps sensible people from switching: what happens if I lose my key or my phone? It is the single most important thing to understand before you roll passkeys out to anyone, so let us do it properly.

The first thing to know is that there are two kinds of passkey, and they behave very differently when a device goes missing.

• Synced passkeys. These live in a service that backs them up and copies them across your trusted devices: Apple's iCloud Keychain, Google Password Manager, or a password manager like Bitwarden or 1Password. Lose the phone, and the passkey is not lost with it. Sign into that same account on a new device and your passkeys are simply there again. The FIDO Alliance, the industry body behind passkeys, calls these synced passkeys precisely because they are backed up and, in its words, "better protected from loss".

• Device-bound passkeys. These are locked inside one piece of hardware, typically a security key such as a YubiKey, and by design they never leave that one device and cannot be copied off it (the FIDO Alliance calls these device-bound passkeys). That is a security strength, but it means if you lose that key, that passkey is gone for good.

Which leads to the one rule I would tattoo on every roll-out: never rely on a single passkey. This is the same point I laboured in part one, and recovery is exactly why. Register two or three from the start, on different devices, and keep one somewhere safe as a spare. A sensible safety net is a second passkey, plus a recovery email on the account, so a lost device is an inconvenience and never a lockout.

But what about the user who ignores all that advice, loses their only phone, and lands in your inbox locked out of your site? For that, you need the break-glass procedure, and it is worth every site owner knowing it.

Break glass: clearing a locked-out user's passkeys and MFA

This one goes a little deeper than the comments, but Chris's question demands it, and it is the sort of thing you want to have read before you need it, not during a panic.

Here is a design decision worth understanding: Joomla deliberately does not give a Super User a button to strip another person's passkey or Multi-factor Authentication from the admin. These are personal security credentials, and letting one account silently remove another's protection would rather defeat the point. Which is fine, right up until someone is genuinely locked out with no working passkey and no backup codes left. At that point the reliable fix is at the database, and you will need Super User plus server or database access to do it, through phpMyAdmin, Adminer, or the command line.

I checked the following on a clean Joomla 6.1 site rather than trusting my memory, so these are the real tables as they stand in Joomla 6. In each case, #__ is the placeholder for your site's actual table prefix (on my test site it was j_, so the real table was j_webauthn_credentials).

Back up the table, or the whole database, before you touch anything. Then:

To remove a user's passkeys, clear their rows from #__webauthn_credentials. That table holds one row per passkey, with the owning user in the user_id column and the friendly name in label:

DELETE FROM `#__webauthn_credentials` WHERE `user_id` = '42';

(The user ID is stored as text in that table, so keep it in quotes. Swap 42 for the locked-out user's ID, which you can read off the Users list in the admin.)

To remove a user's Multi-factor Authentication methods, clear their rows from #__user_mfa. That is where Joomla 4.2's MFA lives, one row per method, again keyed on user_id:

DELETE FROM `#__user_mfa` WHERE `user_id` = 42;

On a very old site that has been upgraded for years, there are two leftover columns from the pre-4.2 two-factor system, otpKey and otep, still sitting in the #__users table. They are almost certainly empty on a modern site, but for belt and braces you can blank them:

UPDATE `#__users` SET `otpKey` = '', `otep` = '' WHERE `id` = 42;

One reassuring note here: in today's Joomla this always works, because you cannot yet switch password login off for a single account. A password is therefore always waiting as a fall-back once the passkey is cleared, so the user is never truly locked out. That safety net would change the day Joomla delivers the fully passwordless account that Nicholas Dionysopoulos has floated, the one I wrote about last month, at which point recovery will need a proper rethink. But that is tomorrow's problem, not today's.

"My computer has no fingerprint reader." The device question

Sarah Eagle asked a brilliant, practical pair of questions: what do you do if your machine has no camera, no fingerprint scanner, no Bluetooth, no near-field communication and no security key? Is the answer "the little USB", and does she mean a generic USB stick?

Let me clear up the USB one first, because it is a really common and completely understandable mix-up. A hardware security key like the YubiKey we just met does look exactly like a small USB stick. But it is not a memory stick, and you cannot use a spare USB drive from your drawer as one. A security key stores no files you can copy; its entire job is to prove, cryptographically, that it is you, and the private key is locked inside the hardware and can never be exported. It is a security token, not a memory stick. So it is a special little device you buy, not a stick you already own.

But here is the reassuring part: Sarah, you very probably do not need to buy anything at all. Two things to know.

First, you do not need biometrics. If your PC has no fingerprint reader or camera, a simple device PIN through Windows Hello does the job perfectly well. The fingerprint and the face are just convenient ways to unlock the passkey; a PIN unlocks it just the same.

Second, and this is the elegant answer to your PS: your phone can be the key for your laptop, even a laptop with none of that hardware. This uses something the standards people call hybrid transport, or cross-device authentication, and it is rather clever. When you go to log in on the laptop, the site shows a QR code. You scan it with your phone. Your phone then does a quick Bluetooth check, purely to confirm that the phone and the laptop are physically close to each other, and then your phone's passkey signs you in. The FIDO Alliance calls this cross-device authentication and describes exactly this case: your phone is linked to your laptop just long enough to sign you in, using WebAuthn hybrid transport under the bonnet. No password ever crosses. The Bluetooth part is only a proximity check, so a scammer on the other side of the world cannot use it, and the passkey itself never leaves your phone. Your phone does need Bluetooth, but the laptop does not need any of it beyond a screen to show the code.

So the short version, Sarah: no camera or fingerprint is absolutely fine. A PIN, or your phone standing in as the key, covers you.

The honest bit, for the sceptics

Now to John Beech, who was refreshingly blunt: he will not put passkeys on his shop, because it is too hard, because "PayPal and Amazon aren't playing nice", because iOS, Windows and the browser all pop up wanting to save a passkey and it confuses his customers, and because, in his words, the whole thing feels a bit bungled. I want to take that seriously rather than wave it away, because a fair chunk of it is true.

The prompt fatigue is real. Set up a passkey on a modern machine and you can genuinely get three different pop-ups, one from the operating system, one from the browser, one from your password manager, all offering to save it. It is a rough edge, and it does confuse people. I will not pretend otherwise.

Where I will gently push back is on the big shops. Both Amazon and PayPal do now support passkeys. Amazon rolled them out to 175 million customers and reckons sign-in is about six times faster than a password. PayPal has expanded passkey login across the United States and in the UK, the one that counts for me, since 27 June 2023. Adoption across the web is real but, as that same report fairly admits, still uneven, which is a decent reflection of what John is running into. So the ground is genuinely shifting, even if the experience is not yet seamless everywhere.

But here is the reframe I would offer John, and it is the whole point. You are not trying to fix the entire internet. On your own Joomla site you control the experience from end to end. You are not at the mercy of Amazon's pop-ups or Apple's prompts. You put a passkey button next to the password box, you leave passwords on for anyone who wants them, and you tell nobody they must switch. Your worry, that making it optional will confuse the people who do not have it, does not really bite, because an optional button that a user can simply ignore is not confusing; it is just there for the people who want it. Offer, do not force, and the mess you are describing stays outside your front door.

A little more of the how, for the curious

Finally, to the reader posting as shoulders, who said, very fairly and as feedback rather than a dig, that part one was a touch light on the technical side and could have done with a diagram and a clearer sense of the pros and cons. That is a completely reasonable ask, so here is a little more of the machinery.

When you create a passkey, your device generates a pair of mathematically linked keys. The public key is handed to the website, which stores it in that #__webauthn_credentials table we met earlier. The private key stays locked in your device's secure chip and never leaves it, not when you log in, not ever. Logging in is a challenge and response: the site sends your device a random puzzle, your device signs that puzzle with the private key after you unlock it with your face, fingerprint or PIN, and the site checks the signature against the public key it holds. The site never learns a secret, so there is nothing in its database for a thief to steal. And because the whole exchange is tied to the site's exact web address, a passkey made for your real site simply refuses to work on a look-alike phishing copy. That last property is the one that makes passkeys special; it is not that they are a stronger password, it is that they cannot be handed to the wrong person even by a fooled user.

A passkey login: challenge, sign, verify. No shared secret is ever sent.

The honest pros and cons, since you asked:

• For: nothing to phish, nothing stealable sitting on the server, faster logins, and no password to reuse across sites or leak in a breach.

• To weigh: you have to think about recovery up front, which is most of this article; device-bound keys tie you to one piece of hardware; and, as John rightly says, the cross-web experience is still maturing and some users will need a hand.

None of that is a reason to wait, in my view. It is a reason to roll out thoughtfully, which is what all your questions have really been about.

Keep them coming

That is your questions answered, or at least the ones I could fit in. My thanks to Richard, Steven, Chris, Sarah, John and shoulders for asking them, and to Bradley for the kind words in the thread. This is exactly how I hoped the first piece would land: not as the last word, but as the start of a conversation. A conversation that helps us to get to the end of passwords.

So the door stays open. If you roll passkeys out to your users and hit something I have not covered, tell me how it went in the comments and it may well become part three. And I will say once more the thing I keep banging on about: the sooner we can retire the password, the better, and every one of you switching a passkey on is how we get there. Lets all put the effort in and make passwords a thing of the past!