What Is a Passkey?

A passkey is a passwordless login credential based on public-key cryptography that authenticates a user without a shared password. A passkey replaces a password with a private and public key pair created under the FIDO2 and WebAuthn standards. The private key stays on the user device, and the website stores only the matching public key, so no secret travels across the network during login.

This article defines a passkey, explains how the key pair and challenge-response process work, states why passkeys resist phishing, compares passkeys with passwords and two-factor authentication, describes how passkeys sync across devices, and summarizes adoption by Google, Apple, and Microsoft. The FIDO2 framework, the WebAuthn specification from the World Wide Web Consortium, and the FIDO Alliance supply the references used here.

Each section answers one question about passkeys and connects to the next. Readers learn why a passkey login transmits no reusable secret and why that property removes the most common attack against passwords.

What Is a Passkey?

A passkey is a FIDO2 and WebAuthn credential that uses a public and private key pair to log in without a password. The device generates the key pair during registration. The private key remains protected on the device, and the website stores the public key.

During login, the device proves possession of the private key without revealing it. A passkey replaces the password entirely rather than supplementing it. The FIDO Alliance and the World Wide Web Consortium define the standards that make passkeys interoperable across browsers and platforms.

How Does a Passkey Work?

A passkey works through a challenge-response exchange where the device signs a server challenge with the private key. The website verifies the signature with the stored public key. The list below states the operating sequence.

1. Registration generates a key pair on the device and sends only the public key to the website.
2. The website stores the public key against the user account and discards nothing secret.
3. Login begins when the website sends a random challenge to the device.
4. The device unlocks the private key with a biometric or PIN and signs the challenge.
5. The website verifies the signature with the public key and grants access.

The biometric or PIN unlocks the local key but never leaves the device or reaches the server. A passkey therefore combines possession of the device with a local verification, which aligns with the layered model described in the overview of how multi-factor authentication combines verification factors.

Why Are Passkeys Phishing-Resistant?

Passkeys resist phishing because no shared secret is transmitted that an attacker could capture or replay. A password is a reusable secret, while a passkey signature is unique to one challenge and one website. The list below states the reasons.

• No shared secret leaves the device, so a fake login page captures nothing reusable.
• Origin binding ties each passkey to the exact website domain, so it will not sign for a lookalike site.
• Per-login signatures are unique to each challenge, which blocks replay of a captured response.
• No server-side password means a breached site database exposes only public keys, which hold no value alone.

Origin binding is the decisive property, because the browser refuses to use a passkey on a domain that does not match the one it was created for. A phishing site on a different domain cannot trigger the legitimate passkey, which neutralizes credential phishing.

How Do Passkeys Differ From Passwords?

Passkeys differ from passwords because passkeys store no shared secret and cannot be reused, guessed, or phished at scale. A password depends on user memory and server storage, while a passkey depends on a protected key pair. The list below states the contrasts.

• Storage differs, because a password is a shared secret while a passkey keeps the private key on the device.
• Phishing exposure differs, because a password can be entered on a fake site while a passkey is bound to the real domain.
• Breach impact differs, because a leaked password database exposes secrets while a leaked passkey database exposes only public keys.
• Reuse differs, because users reuse passwords across sites while each passkey is unique to one site.

Password weaknesses such as reuse and weak choices drive most account takeovers. A passkey removes the secret that those attacks target rather than asking users to manage it more carefully.

How Do Passkeys Compare to Two-Factor Authentication?

A passkey replaces both the password and a separate second factor by combining device possession with local biometric or PIN verification in one step. Traditional two-factor authentication adds a code on top of a password. The list below states the comparison.

• Two-factor authentication keeps the password and adds a second factor such as a one-time code.
• A passkey removes the password and proves possession plus local verification in a single action.
• One-time codes remain phishable because a user can enter a code on a fake site.
• A passkey signature is not phishable because it binds to the real domain and transmits no code.

A passkey provides phishing-resistant strength comparable to a hardware security key while remaining simpler to use. Both build on the FIDO2 standard, which the broader two-factor methods are described in the guide on how to set up two-factor authentication.

How Do Passkeys Sync Across Devices?

Passkeys sync across devices through encrypted cloud keychains that share the private key between a user own devices. Syncing keeps a passkey available on a phone, tablet, and computer. The list below states how syncing works.

• Synced passkeys replicate through a provider keychain such as iCloud Keychain or Google Password Manager.
• End-to-end encryption protects the synced private key so the provider cannot read it.
• Cross-device sign-in lets a phone authenticate a login on a nearby computer through a scanned code and Bluetooth proximity.
• Device-bound passkeys stay on one device, such as a hardware security key, and do not sync.

Synced passkeys favor convenience and recovery, while device-bound passkeys favor maximum isolation. A user signs in on a new device by restoring the keychain or by approving the login from an existing device.

Which Companies Support Passkeys?

Passkeys are supported by Google, Apple, and Microsoft across their operating systems and browsers. The three platform vendors built passkey support into consumer accounts. The list below states the adoption.

• Apple supports passkeys through iCloud Keychain on iOS, iPadOS, and macOS.
• Google supports passkeys for personal Google Accounts and through Google Password Manager on Android and Chrome.
• Microsoft supports passkeys for personal accounts and through Windows Hello on Windows.
• The FIDO Alliance coordinates the standard so passkeys work across these platforms and major browsers.

Coordinated support across the three vendors lets a passkey created on one platform authenticate through cross-device sign-in elsewhere. Major services including Amazon, PayPal, and GitHub also accept passkeys for account login.

How Does a User Recover a Passkey?

A user recovers passkeys by restoring the synced keychain on a new device or by enrolling a fresh passkey through a backup method. Recovery depends on whether the passkey syncs. The list below states the recovery paths.

• Synced passkeys return automatically when the user signs in to the platform keychain on a replacement device.
• Account recovery re-enrolls a new passkey after identity verification when no device holds the key.
• Backup factors such as a second passkey or a recovery code provide access if the primary device is lost.
• Device-bound passkeys require a registered backup key, since a lost hardware key does not sync.

Registering a second passkey on a separate device removes the risk of lockout from a single lost device. Recovery planning matters most for device-bound passkeys, which carry no automatic cloud backup.

What Is the Difference Between a Passkey and a Hardware Security Key?

A passkey is a software credential that can sync across devices, while a hardware security key is a physical device that stores a credential on dedicated hardware. Both build on the FIDO2 standard. The list below states the distinction.

• A synced passkey replicates through an encrypted cloud keychain across a user own devices.
• A hardware security key, such as a YubiKey, stores a device-bound credential on a separate physical token.
• Hardware keys resist device malware because the private key never leaves the dedicated hardware.
• Synced passkeys favor recovery and convenience, while hardware keys favor maximum isolation.

A hardware security key is itself a device-bound passkey under the FIDO2 standard. The choice between a synced passkey and a hardware key trades convenience against the strongest isolation from a compromised device.

How Does a Passkey Protect Against Credential Stuffing?

A passkey blocks credential stuffing because it stores no reusable password that an attacker can replay across sites. Credential stuffing reuses leaked username and password pairs against many services. The list below states why passkeys defeat the attack.

• No password exists for a passkey account, so a leaked credential list contains nothing to replay.
• Unique key pairs per site mean a credential stolen from one service does not unlock another.
• Public-key storage on servers exposes only public keys in a breach, which cannot authenticate alone.
• Origin binding prevents a captured response from working on any site other than the original.

Credential stuffing succeeds because users reuse passwords across services. A passkey removes the reusable secret entirely, which neutralizes the leaked-credential lists that drive these automated attacks.

Key Takeaways

• A passkey is a FIDO2 and WebAuthn credential using a public and private key pair.
• The private key stays on the device, and the website stores only the public key.
• A challenge-response signature proves identity without sending a secret.
• Passkeys resist phishing because they bind to the real website domain.
• A passkey replaces both the password and a separate second factor.
• Synced passkeys replicate through encrypted cloud keychains.
• Google, Apple, and Microsoft support passkeys across their platforms.

Passkey vs Password vs Two-Factor Comparison

The table below compares passkeys, passwords, and two-factor authentication across the attributes that determine security.

Last Thoughts on Passkeys

A passkey replaces the password with a public and private key pair under the FIDO2 and WebAuthn standards, keeping the private key on the device and the public key on the server. The challenge-response signature proves identity without transmitting a reusable secret, and origin binding makes the credential phishing-resistant. A passkey collapses the password and a second factor into one step, syncs through encrypted keychains, and works across Google, Apple, and Microsoft platforms.

Strong account protection often pairs passkeys with a password manager for accounts that lack passkey support, covered in the guide on how to use a password manager. The hub on cybersecurity and authentication methods places passkeys within the wider move toward passwordless login.