|
Contact Press Office:
Email: press@dos.ny.gov
Phone: 518-486-9844
November 12, 2026
CONSUMER ALERT:
Do You Know the Difference Between a Password and a Passkey? The New York Department of State’s Division of Consumer Protection Issues Guidance to Help New Yorkers Safeguard Their Digital Information
Understand the differences between passwords, passkeys, password managers and multifactor authentication
Secretary Mosley: “With new technologies come new learning curves, including becoming familiar with the terminology used to navigate them. The Division of Consumer Protection is committed to helping New Yorkers stay informed and equipped with the knowledge they need to navigate the ever-evolving digital world and protect their personal information.”
The New York Department of State’s Division of Consumer Protection is urging New Yorkers to practice safe digital habits to secure their digital devices and online accounts. With digital technology being prevalent in so many aspects of life today, consumers are constantly being exposed to new streams of information and technology terms. That’s why it is important to understand the key terms and tools that can help protect your devices, accounts and personal information.
“How many times have you gone to sign in to an account and been asked if you want to save your password? While features like this make managing online accounts more convenient, understanding the technology and the terms used to describe it is just as important,” said Secretary of State Walter T. Mosley. “With new technologies come new learning curves, including becoming familiar with the terminology used to navigate them. The Division of Consumer Protection is committed to helping New Yorkers stay informed and equipped with the knowledge they need to navigate the ever-evolving digital world and protect their personal information.”
Acting New York State Chief Information Officer Jenson Jacob said, “As cyber threats become increasingly sophisticated, managing digital accounts is no longer just about having a strong password, To protect data effectively, we must understand the authentication tools available and how they work together. At ITS, our goal is to empower all New Yorkers with both the practical tools and the resources they need to protect their information online.”
Passwords, passkeys, password managers and multifactor authentication each play a role in protecting your digital accounts, but do you understand how these terms differ from one another? The Division of Consumer Protection shares a breakdown of these common terms that prevent cybercriminals from gaining access to your devices and accounts.
COMMON TERMS EXPLAINED:
Passwords: A password is a combination of letters, numbers and symbols used to verify your identity and grant access to a computer system, online account or other secured resource. It is important to create a strong and unique password to protect your account from being exploited by cybercriminals, as a weak password could be guessed and result in your account getting hacked. To improve the security of a password and reduce the risk of guessing, include the following:
- Make it long. 12+ characters is recommended
- Make it random. Avoid personal info, common words or predictable patterns
- Use a passphrase. Combine unrelated words with separators (e.g., Dog4Winter-zipp!)
-
Change and retire old passwords, especially after a breach
Unfortunately, passwords are still vulnerable to phishing attacks, data breaches and, if the password isn’t complex enough, password guessing all of which could lead to fraudulent access to your accounts. Visit the Federal Trade Commission (FTC) for more tips on how to create a complex password, and check out our consumer alert on account takeover fraud to learn what immediate action steps to take if your online account has been compromised.
Password Manager: A password manager is a locked vault app that creates and remembers all your passwords for you, so you only have to remember ONE strong master password. For example, if you have 10 accounts, a password manager can create 10 strong unique passwords for you automatically. When accessing one of your secured accounts, you unlock the vault with one master password or your face ID or fingerprint, and the password manager will autofill the appropriate password so you never have to type or remember it.
Multifactor Authentication (MFA): Is a process that requires two or more forms of verification to confirm the identity of a user or device. MFA usually includes a password and at least one other step, such as a text message or email confirmation code, or the use of an authenticator app, for authentication. MFA offers an extra layer of protection against unauthorized access. Learn how to enable MFA here.
Passkey: A passkey is an authentication method that doesn’t require a password. Instead, it uses your device PIN or biometrics, like your face ID or fingerprint, to securely sign in to your online accounts. A passkey can replace traditional passwords by relying on a unique pair of digital keys for each user and device – a private key kept securely on your device and never shared, and a public key sent to the website or app to verify your identity. When you sign in, your device unlocks your private key using your face ID, fingerprint, or device PIN, and the website or app verifies it with the public key.
Passkeys have many advantages over passwords; they cannot be stolen in a phishing attack and if a server is hacked, a data breach would expose only public keys, which are useless without the private key. While passkeys have become available on a wide range of websites and apps in recent years, passkey systems may not yet be compatible with all devices, operating systems, platforms or applications as they are still in their early stages.
As technologies continue to evolve, so do the tactics used by scammers. While emerging digital tools offer many benefits, it is important to remain vigilant, understand these important terms and how they differ, and protect your devices, accounts and personal information. For more digital safety tips, check out the NYS Office of Technology’s helpful tips and resources.
###
|
