BLOG
Blog
Practical notes for developers and the people who run logins: adding passkeys, protecting accounts, and rolling it all out.
Account security
Credential stuffing defense: what login operators should do
Credential stuffing replays username and password pairs leaked from other sites against your login. Here is how to defend against it with MFA, breached-password checks, rate limits, bot defenses, user alerts, and passkeys.
Account security · Rollout & operations
After a data breach: what passkeys stop, what they don't, and what to check in your login
A practical checklist for teams that run a login after a wave of customer data breaches: what passkeys can and cannot prevent, credential stuffing and phishing, recovery flows, and how to add passkeys to an existing login step by step.
Implementation · SealGate
How to add passkeys to an existing login without dropping passwords
A step-by-step plan for adding passkeys to a password login you already run, covering the RP ID, enrollment after sign-in, button and autofill sign-in, device management, recovery, and when to retire passwords.
Passkey basics
What is a passkey? How it works and how it differs from a password
A passkey is a sign-in credential based on FIDO2 / WebAuthn and public-key cryptography. Here is how it works for developers, why it resists phishing, and what the server actually stores.