A passkey is a passwordless sign-in credential built on the FIDO2 standards, consisting of a public and private key pair that is created for one specific website or app. In cybersecurity identity and access management, a passkey replaces the shared secret of a password with public-key cryptography: the service stores only the public key, while the private key stays on the user’s device or in a password manager and is unlocked with a fingerprint, face scan, PIN or device password.
Passkeys are designed to be both easier to use and harder to steal than passwords. Because each credential is cryptographically bound to the domain where it was registered, a fake website cannot obtain a usable signature, which makes passkeys resistant to phishing by design.
How passkey authentication works
Passkeys use the WebAuthn browser interface and the CTAP protocol, the two parts of FIDO2. During registration, the website sends a random challenge and its identifier, known as the relying party ID. The user’s authenticator generates a new key pair for that relying party, keeps the private key and returns the public key and a credential ID to the server.
During sign-in, the server sends a fresh challenge. The authenticator checks that the request comes from the same domain the passkey belongs to, asks the user for a local verification such as a fingerprint and signs the challenge with the private key. The server verifies the signature with the stored public key. No secret ever travels over the network, and the biometric never leaves the device.
| Component | Role | Example |
|---|---|---|
| Relying party | The service that stores public keys | A web shop or company portal |
| Client | Mediates between site and authenticator | Browser or operating system |
| Authenticator | Holds private keys and verifies the user | Phone, laptop chip, security key |
| User verification | Proves the device holder is present | Fingerprint, face, PIN |
| Credential provider | Stores and syncs passkeys | Platform keychain or password manager |
Synced and device-bound passkeys
Passkeys come in two main forms. Synced passkeys are stored by a credential provider and copied across the user’s devices through an end-to-end encrypted service, so losing a phone does not mean losing access. Device-bound passkeys live in one piece of hardware, typically a FIDO2 security key, and the private key cannot be exported.
| Property | Synced passkey | Device-bound passkey |
|---|---|---|
| Storage | Provider keychain across devices | Single hardware authenticator |
| Recovery after loss | Restored from the synced account | Requires a backup key or fallback |
| Assurance level | Depends on the provider account security | Highest, key never leaves hardware |
| Typical use | Consumer accounts, general workforce | Administrators, regulated access |
| Attestation | Often limited | Can prove authenticator model |
Users can also sign in on a device that holds no passkey by using cross-device authentication: the computer shows a QR code, the phone scans it, and a Bluetooth proximity check ensures the phone is physically nearby. This proximity check prevents a remote attacker from relaying the request.
Passkeys compared with passwords and other factors
Passkeys change authentication, the process of proving identity, not authorization, which decides what an authenticated identity may do, for example through RBAC. Compared with passwords and traditional MFA, they remove the reusable secret that most account takeovers depend on.
| Method | Phishing resistance | Reuse risk | User effort |
|---|---|---|---|
| Password only | None | High, often reused | Remember and type |
| Password plus SMS code | Low, codes can be relayed | Password still reusable | Wait and type a code |
| Password plus authenticator app | Low to moderate | Password still reusable | Open app and type |
| Push approval | Moderate with number matching | Password still reusable | Approve on phone |
| Passkey | High, bound to the domain | None, unique per site | Fingerprint or PIN |
A passkey can count as multi-factor authentication on its own: possession of the device holding the private key is one factor, and the biometric or PIN used for local verification is a second. Within single sign-on, passkeys are typically registered with the identity provider, so one strong sign-in protects every connected application.
Deploying passkeys
For service operators, passkey support means implementing WebAuthn registration and verification on the server, usually through a maintained library rather than custom cryptography. Key decisions concern account recovery, the fallback methods kept for users without passkeys and whether to require device-bound keys for sensitive roles.
- Offer passkeys alongside passwords first, then encourage enrollment at sign-in and after password resets.
- Register more than one authenticator per user, such as a phone and a laptop, or a backup security key for administrators.
- Harden recovery, because a weak email-based reset path lets attackers bypass the passkey entirely.
- Retire phishable fallbacks for privileged accounts once passkey coverage is complete.
- Set the relying party ID carefully, because it fixes which domains and subdomains can use the credential.
Limitations and misconceptions
Passkeys are a major improvement, but they are not a complete security solution. Several limits deserve attention when planning a rollout.
- Session theft remains possible: malware on the device can steal session cookies after a valid sign-in, so endpoint protection still matters.
- Recovery is the weak point: an account is only as secure as its easiest recovery path.
- Provider lock-in concerns: moving passkeys between ecosystems has historically been difficult, although export standards are emerging.
- The biometric is not sent to the server: a common misconception is that services collect fingerprints, but the scan only unlocks the local key.
The overall effect is still decisive: by removing shared secrets from the login process, passkeys eliminate the credential phishing and password reuse that underpin a large share of account compromises.
Understanding it simply
A passkey is a digital key that replaces a password. There is nothing to remember and nothing to type. The phone or computer creates a unique key for each website and keeps it safe.
To sign in, the user simply touches a fingerprint sensor, looks at the camera or enters the device PIN. The key works only on the real website it was made for. A fake look-alike site gets nothing useful, so tricking someone into giving it away becomes nearly impossible.
Applied in practice
A regional health insurer with about 3,000 employees suffers repeated account takeovers after staff enter passwords and SMS codes into convincing fake login pages. The security team enables passkeys in its identity provider, asks every employee to register a passkey on a company laptop and a phone, and issues hardware security keys to the 60 administrators.
Over three months, password sign-in is removed for administrators and then made optional for everyone else. Recovery requires an identity check with the help desk instead of an email link. When a new phishing campaign targets the company later that year, several employees click the link, but no usable credentials are captured. The outcome is that the attack stops at the login page instead of becoming an incident.