Meta Description: Learn how HubSpot's new passkey support for 2FA eliminates phishing risks and streamlines login. Step-by-step setup guide, authentication comparison, and rollout best practices.
Your CRM holds some of the most sensitive data in your organization — customer contact information, deal values, communication histories, proprietary sales strategies. Yet for most teams, the only thing standing between that data and a bad actor is a password that someone probably reuses across a dozen other websites.
HubSpot has taken a major step forward in CRM security by adding passkey support as both a login method and a two-factor authentication option. Passkeys represent the biggest shift in authentication technology since the introduction of 2FA itself — a shift that Apple, Google, Microsoft, and the FIDO Alliance have been building toward for years.
In this guide, we'll break down exactly what passkeys are, why they matter for CRM security, how to set them up in HubSpot, and how to roll them out across your team. We'll also compare passkeys to every other authentication method so you can make informed security decisions for your organization.
Think of passkeys like a bank safety deposit box. The box requires two keys to open: the bank has one key, and you have the other. To access the box, you prove your identity (with your ID) and present your physical key. One key alone can't open the box.
Passkeys work the same way — except your "key" is stored securely on your device and unlocked with your fingerprint, face scan, or PIN.
Passkeys use public key cryptography based on the FIDO2/WebAuthn standard:
The private key never leaves your device and is never shared with HubSpot. This means there's literally nothing for an attacker to steal from HubSpot's servers — even in the event of a data breach.
Traditional 2FA requires two separate steps: enter your password (something you know) and then enter a code from your phone (something you have). Passkeys combine multiple factors into a single seamless action:
This is why passkeys don't just replace passwords — they replace passwords and traditional 2FA in one step.
Compromised credentials are the number one cause of data breaches year after year, according to Verizon's Data Breach Investigation Report. The reasons are well-documented:
For CRM platforms like HubSpot, the stakes are especially high. A compromised CRM account can expose customer personal information, sales pipeline data, communication histories, marketing lists, financial information, and integration credentials for connected systems.
| Risk | Passwords + Traditional 2FA | Passkeys |
|---|---|---|
| Phishable | Yes — fake login pages can capture both passwords and TOTP codes | No — cryptographically bound to the legitimate domain |
| Reusable across sites | Yes — users frequently reuse passwords | No — each passkey is unique to a single service |
| Requires memorization | Yes — complex password rules lead to weak passwords | No — nothing to remember |
| Interceptable via SIM swap | Yes — SMS-based 2FA is vulnerable | No — no SMS or phone number involved |
| Vulnerable to credential stuffing | Yes — leaked passwords from other breaches can be tried | No — no shared secret to stuff |
| Subject to brute force attacks | Yes — weak passwords can be cracked | No — cryptographic keys can't be guessed |
This deserves special emphasis. Passkeys are phishing-resistant by design. Here's why:
When you use a passkey, your browser verifies that the website requesting authentication actually matches the domain the passkey was created for. If an attacker creates a fake hub5pot.com login page, your passkey simply won't work there — your browser knows it's not hubspot.com.
This is fundamentally different from passwords and TOTP codes, which you can type into any form on any website. Even the most sophisticated phishing page can't trick a passkey.
The entire process takes less than 60 seconds.
If you use devices across different ecosystems (e.g., a MacBook and an Android phone), you have two options:
Option A: Create multiple passkeys
Option B: Use a cross-platform password manager
If you use a password manager like 1Password, Bitwarden, or Dashlane, you can create one passkey that syncs across all your devices regardless of platform. This is the recommended approach for users with mixed ecosystems.
Passkeys also work on the HubSpot mobile app for both iOS and Android. Note that passkeys must first be created on desktop, but once created, they can be used to log in on mobile.
Super Admins can mandate passkeys as the required login method for all users:
Users will receive email notifications about the new requirement and will be prompted to set up passkeys on their next login.
You can also configure approved 2FA methods separately:
Pro Tip: During the transition period, keep at least one legacy 2FA method enabled as a fallback. Once your team is fully onboarded to passkeys, you can tighten the restrictions.
Understanding where passkeys fit in the security hierarchy helps you make better decisions for your organization.
According to the FIDO Alliance's 2025 Passkey Index:
Real-world results from early adopters confirm the benefits:
Audit your current authentication landscape:
Check device compatibility:
Communicate the change:
Enable passkeys as an option:
Provide setup support:
Track adoption metrics:
Tighten 2FA requirements:
Mandate passkeys as a required login method:
Monitor and support:
It's worth noting the contrast between how HubSpot and Salesforce are approaching phishing-resistant authentication:
Salesforce has been progressively mandating stronger security measures. Their 2026 security roadmap includes enforcing phishing-resistant MFA for high-privilege accounts, with broader requirements rolling out over time. Salesforce's approach is compliance-driven — organizations must meet deadlines or risk losing access.
HubSpot is taking a more adoption-friendly path. By offering passkeys across all subscription tiers (including Free) and providing a gradual enforcement mechanism, HubSpot makes it easy for organizations to adopt at their own pace while still providing the tools Super Admins need to mandate stronger security when they're ready.
The takeaway: Whether your organization uses HubSpot, Salesforce, or both, the industry is clearly moving toward phishing-resistant authentication. The organizations that adopt passkeys proactively — rather than waiting for mandates — will be better protected and face smoother transitions.
Passkeys align with emerging security frameworks and regulations:
Every password in your organization is a potential attack vector. By moving to passkeys, you:
HubSpot often serves as the hub for a web of business integrations — email, calendar, marketing automation, payment processing, and more. A compromised HubSpot account doesn't just expose CRM data; it can provide access to connected systems. Passkeys help secure the entire ecosystem by hardening the primary access point.
A passkey is a cryptographic credential that replaces passwords entirely. Instead of typing a memorized string of characters, you authenticate using your device's biometrics (fingerprint or face scan) or a PIN. Passkeys use public key cryptography, meaning the secret (private key) never leaves your device and can't be phished, guessed, or stolen from a server breach.
Yes. Passkey support is available across all HubSpot products and subscription tiers, including the free CRM. This is a universal security improvement that every HubSpot user can take advantage of.
Yes, you can use passkeys to log in to the HubSpot mobile app on both iOS and Android. However, passkeys must first be created on the desktop version of HubSpot. Once created, they sync across your devices through your platform's cloud keychain (iCloud Keychain, Google Password Manager) or your password manager.
If your passkey is synced through a cloud service (iCloud Keychain, Google Password Manager) or a password manager, you can access it from another device signed into the same account. If you lose access entirely, you can complete the recovery process for the service where the passkey is stored. HubSpot also allows you to have multiple passkeys, so setting up a backup passkey on a second device is recommended.
If your organization requires SSO for HubSpot login, passkeys are not applicable — SSO handles the authentication flow. However, if SSO is available but not required, individual users can choose to use passkeys instead.
A few to note: (1) Each user can only set one passkey per authenticator type. (2) Passkeys don't work with the Microsoft Outlook desktop app's embedded browser — they work fine in Outlook Web. (3) The HubSpot Sales Extension in a web browser supports passkeys. (4) Passkey setup is currently desktop-only, though login works on both desktop and mobile.
Hardware security keys (YubiKey, Titan Key) are a type of FIDO2 authenticator and are fully compatible with HubSpot's passkey support. The main difference is that hardware security keys don't sync — they're tied to the physical device. Syncable passkeys (stored in your platform keychain or password manager) offer more convenience, while hardware keys offer the highest security for organizations with strict compliance requirements. Both are phishing-resistant.
HubSpot's passkey support represents a significant leap forward in CRM security. By adopting passkeys, your organization gains phishing-resistant authentication that's actually easier to use than the passwords and 2FA codes it replaces.
The industry trend is unmistakable: 87% of enterprises are already deploying passkeys, and the FIDO Alliance reports a 93% login success rate compared to 63% for traditional methods. Whether driven by security best practices, compliance requirements, or simply wanting to eliminate password headaches, the case for passkeys is clear.
Don't wait for a mandate. Start your passkey rollout today and give your team the most secure, most convenient way to access your CRM.
Vantage Point helps organizations implement robust security practices across their CRM platforms. Whether you need help rolling out passkeys across your HubSpot portal, configuring advanced security settings, or building a comprehensive CRM security strategy, our team is ready to help.
Contact Vantage Point to discuss your CRM security needs.
Vantage Point is a CRM consulting firm specializing in Salesforce and HubSpot implementations, integrations, and optimization. As partners of Salesforce, HubSpot, Anthropic (Claude AI), Aircall, and Workato, we help businesses of all sizes build secure, connected, and intelligent customer platforms. From Data Cloud and MuleSoft integrations to AI-powered automation, Vantage Point delivers solutions that drive growth and protect your most valuable asset — your customer relationships. Learn more at vantagepoint.io.