Simon Willison’s Weblog

27th February 2026 - Link Blog

Please, please, please stop using passkeys for encrypting user data (via) Because users lose their passkeys all the time, and may not understand that their data has been irreversibly encrypted using them and can no longer be recovered.

Tim Cappalli:

To the wider identity industry: please stop promoting and using passkeys to encrypt user data. I’m begging you. Let them be great, phishing-resistant authentication credentials.