July 20, 2026
Passkey or password in disguise?
Opaque, Interoperable Passkey Records (and a Go API)
Techies are fighting over whether passkeys just got turned back into passwords
TLDR: A new proposal wants websites to store passkey login data in one standard, portable text format so developers can switch tools more easily. The community instantly split between “finally, practical” and “wait, did you just reinvent passwords with extra steps?”
A fresh proposal to make passkeys easier to store and move between apps was supposed to be a neat quality-of-life upgrade for developers. The basic idea is simple: instead of every website inventing its own weird database setup, passkey info could be stored in one standard text format and handed to software like a sealed label. Supporters see that as a practical fix for one of passkeys’ biggest problems: they’re safer than passwords, but much more annoying to build on the back end.
But the comment section immediately did what comment sections do best: turn a tidy standards discussion into a miniature identity crisis. The loudest reaction was a brutally simple joke from one reader who said, essentially, “So we made passkeys into strings… and when you store a secret string in your password manager, that’s called a password.” Ouch. That line became the thread’s unofficial punchline, because it captures the community’s anxiety that security tools keep reinventing old ideas with shinier branding.
Others were less punchy and more suspicious, zooming in on the wording and spec references like detectives on a crime board. One commenter practically live-blogged their confusion over how the article described the data format, highlighting a classic internet drama: is this elegant simplification, or just complicated tech being wrapped in friendlier packaging? In other words, the proposal promises portability and less lock-in, while the crowd is busy asking whether the emperor’s new passkey is just a password in a trench coat.
Key Points
- •The article proposes an interoperable storage format for passkey records so applications can handle them as opaque strings rather than custom database schemas.
- •It says current WebAuthn guidance and libraries still often leave applications with non-interoperable credential storage designs.
- •The proposed `c2sp.org/passkey-record` format uses PHC-style string syntax and stores authenticator data as the main payload, with transports encoded as parameters.
- •The article says a standardized record format could let developers switch passkey libraries or backend languages without losing credential databases.
- •It also outlines a draft stateless Go `crypto/passkey` API, including a registration flow built around `RelyingParty.NewRegistration` and browser creation APIs.