Login with Passkeys: the best Joomla feature you have been ignoring

Be honest. When you spin up a fresh Joomla site and you spot that login option you do not quite recognise, do you turn it on, or do you quietly disable it and reach for a password like you always have?

If it is the latter, you are not alone, and that is a bit of a shame. Because Joomla has shipped a genuinely brilliant, phishing-proof, passwordless login for years. We just gave it such a forgettable name that most people walked straight past it. The good news is that has now changed, and the name on the tin finally matches what the rest of the world has started calling it: passkeys.

The magazine's own login box. One click on Sign in with a passkey and you are in.

We did not build something new. We renamed something brilliant

Here is the part that always makes me smile. Joomla did not invent passwordless login last week to jump on a bandwagon. We have had it since Joomla 4.0, built on the W3C Web Authentication standard, usually shortened to WebAuthn, and most of the heavy lifting was done by Nicholas K. Dionysopoulos. At the time it was, in his own words, about five years ahead of its time. I have used it on my own sites for years, and as someone who spends rather a lot of time thinking about Joomla security, watching the rest of the industry slowly arrive at where Joomla already was has been quietly satisfying.

And that was rather the problem. The login option sat there labelled "W3C Web Authentication (WebAuthn) Login", which is the sort of phrase that makes a normal site owner back away slowly. Nobody knew what it was, so nobody used it.

So Nicholas raised an issue (number 41077, if you like to read along) making a simple case: stop calling it WebAuthn in the interface and call it what Apple, Google, Microsoft and the FIDO Alliance all now call it. Call it passkeys. It was a language change, not a code change, but it matters enormously, because a feature nobody understands is a feature nobody switches on. In current Joomla, now on 6.1, the tab in your profile reads "Passkey Login", and the plugin behind it is "System - Passkey (Passwordless) Login".

Same superb feature. A name people actually recognise. Sometimes that is the whole job.

So what is a passkey, really?

Let us strip away the jargon. A password is a shared secret: you know it, the website knows it, and anybody who steals it from either of you can waltz right in. A passkey works completely differently.

When you create a passkey for a site, your device quietly generates a pair of cryptographic keys. The public key is handed to the website to keep. The private key never leaves your device, ever. When you log in, the site sends a little challenge, your device signs it after you unlock with a fingerprint, a face scan or a PIN, and the site checks the signature against the public key it stored. At no point does the website hold a secret that a hacker could steal, because there is no secret to steal.

Think of it like a very trustworthy doorman who recognises your signature but has never been told your name or your address, so even if someone breaks into his little booth, there is nothing in there worth taking.

The really clever bit is that a passkey is tied to the exact web address it was made for. So if a scammer sends you to a convincing fake of your own site, your passkey simply will not work there. It cannot be tricked, which means you cannot be tricked. For a CMS that powers everything from charities to councils, that is a big deal, and it is the kind of protection no amount of "please choose a strong password" advice has ever managed to deliver.

And the experience bears that out. Microsoft, one of the companies leading the passwordless push, reports that sign-ins with a passkey succeed about 98 per cent of the time, against just 32 per cent for passwords, and are several times faster than tapping in a password and a one-time code. Because there is no secret to fumble, forget or mistype, the whole thing is simply less effort and less hassle. Faster and safer in the same breath is a rare thing; usually you have to pick one.

This is not a fringe idea any more, either. On World Passkey Day in May 2026 the FIDO Alliance estimated more than five billion passkeys in use around the world, with three quarters of people having switched one on for at least one account. Every major platform now backs them out of the box, and Microsoft alone says it registers close to a million new passkeys every single day. The UK's National Cyber Security Centre goes further still, judging passkeys more secure than traditional two-step login against all the common attacks. Joomla has simply been quietly ready for this moment for years.

Hang on, do I not already do this with MFA?

Good question, and if you switched on Multi-factor Authentication when it arrived in Joomla 4.2, you are part of the way there already. I wrote about MFA at the time, and you may well tap a security key or approve a prompt on your phone as a second step when you log in. That is the very same WebAuthn technology, but used as a second lock, bolted on after your password.

Passkeys take that same technology and do something bolder with it. Instead of being the second lock after your password, the passkey becomes the only lock you need. No password first, no password at all. Same family, rather different ambition, and the reason it matters is everything we just said about phishing: you cannot lose, leak or reuse a password that does not exist.

Turning it on in your Joomla site

Enough theory. Let us actually use it. The setup is refreshingly short.

First, a couple of requirements to check:

• Your site must run over HTTPS with a valid, signed certificate. A free Let's Encrypt certificate is absolutely fine; passkeys just will not run over plain HTTP.

• Your server needs the PHP OpenSSL extension, plus either the GMP or the BCmath extension. Most decent hosts have these already.

Now the steps:

1. Make sure the "System - Passkey (Passwordless) Login" plugin is enabled. On most sites it already is, and there is nothing to configure.

2. Log in to your account the old-fashioned way, with your username and password, the one time.

3. Go to your profile (the User menu, then Edit Account) and find the "Passkey Login" section.

4. Click "Add New Passkey" and follow the prompt from your browser or device. That is the moment your passkey is created, and you can give it a friendly name so "work laptop" and "phone" are easy to tell apart later.

5. From then on, the passkey button is waiting for you on the standard Joomla login screen. No password required.

The Passkey Login section in your Joomla profile, with a passkey registered. Multi-factor Authentication is a separate section, lower down.

What can you actually use as your authenticator? Pleasingly, almost anything modern:

• The device unlock you already use every day: Touch ID or Face ID on a Mac, iPhone or iPad, Windows Hello on a PC, or the biometric unlock on an Android phone.

• A separate hardware security key, the little USB, NFC or Bluetooth devices such as a YubiKey, if you like a belt-and-braces approach.

• Your phone, which can act as the key for your laptop.

And because Apple's iCloud Keychain, Google Password Manager and the likes of 1Password and Bitwarden now sync passkeys, one passkey can follow you neatly from device to device. Set it up once, use it everywhere.

Signing in: your browser or password manager (here, Bitwarden) offers the passkey it holds for the site.

Is it worth having more than one passkey?

Here is a question worth chewing on. If I set up three passkeys, say Windows Hello on my PC, one in my password manager and a hardware key in a drawer, have I made myself safer, or just handed an attacker three doors to try instead of one?

With the old Multi-factor Authentication, that worry was real, because the trouble there was mixing strong methods with weak ones. If you could log in with a hardware key or a code texted to your phone, an attacker simply ignored the key and went after the text, because a chain is only as strong as its weakest link.

Passkeys are different in one important way: there is no weak link to drag you down, as long as every one of them is a genuine passkey. They are all built on the same phishing-resistant cryptography, so there is no flimsy text-message option to slip through. One important aside: a six-digit code from an app like Google Authenticator is not a passkey. It is the old shared-secret idea, and it can be phished, so do not count it as one.

It is fair to say each passkey is another strong lock that on its own opens the door, so you have widened the surface a little. But these locks are formidable: the private key sits in your device's secure chip or your password manager's encrypted vault and will not move without your fingerprint, face or PIN. A hardware key or your device's built-in authenticator is the sturdiest; a passkey synced through a password manager is only as strong as that vault's master password, so look after it.

The real weak link, though, is usually none of your passkeys. It is whatever you leave switched on as a backup. Keep password login enabled and an attacker will ignore your passkeys and go after the password instead.

So my view is that more than one passkey is a good idea, mostly for a reason that has nothing to do with attackers: a lost or broken device never locks you out, and never forces you onto a weaker recovery route. Set up two or three, keep one safe as a backup, and turn off the weak fallbacks once you are confident. The sooner we can retire the password altogether, the better, and passkeys are how we get there.

Where this is all heading

The rename is not the end of the story; it is the start of the interesting part. The long-term plan, sketched out in that same issue, is genuinely exciting. Once browser support is everywhere, Joomla can let you log in with nothing but your passkey, no username to type at all. And then comes the bit I am most looking forward to: the option to switch off password logins for your account entirely.

Have a think about what that means. If an account has no password, there is no password to phish, no password to reuse, and no password to brute force. That whole exhausting category of attack, the one we have been firefighting with login limiters and lockout rules and captchas for the best part of two decades, simply stops being a thing. We do not patch the problem. We delete it.

Which is why I would gently argue we should be retiring passwords as early as we sensibly can, rather than treating it as a someday. Every account that goes passwordless is one more that drops out of reach of this whole class of attack for good. The technology is ready, it is in Joomla today, and the sooner we lean into it the safer the whole community becomes.

Go and switch it on

So here is my ask. The next time you are in your Joomla site, do not skip past that passkey option. Take five minutes, register a passkey, and have a go at logging in with your fingerprint or your face. It feels a little bit like magic the first time, and then it just feels normal, and then you will wonder why you ever typed a password into anything.

If you do try it, I would love to hear how you got on, which authenticator you used and whether it has changed how you think about logging in. Drop a comment below, and if there is appetite I am very happy to follow up with a piece on rolling passkeys out to your clients and staff without the support calls.

Joomla got here early. It is well past time we all started using it.