What Is a Passkey?

What Is a Passkey?

A passkey is a FIDO2 and WebAuthn credential that uses a public and private key pair to log in without a password. Your device generates the key pair the first time you register, and the two keys split a single job that a password used to do alone:

• Private key: created and stored on your device, protected by the hardware, and never sent to the website or across the network.
• Public key: handed to the website during registration and stored against your account, where it can verify a signature but cannot create one.
• No password: the passkey replaces the password entirely rather than adding to it, so there is no secret to remember or for a server to keep.

The FIDO Alliance and the World Wide Web Consortium define the standards that make passkeys work the same way across browsers and platforms. A passkey is the consumer-friendly name for a FIDO2 credential that a phone, laptop, or security key can hold.

How Does a Passkey Sign-In Work?

A passkey works through a challenge-response exchange: the site sends a random challenge, your device signs it with the private key, and the site verifies the signature with the public key. The full sequence runs in a single tap:

• The site sends a challenge. When you start to log in, the website generates a fresh random value and sends it to your device.
• You unlock the device. A fingerprint, face scan, or PIN unlocks the private key locally. This check never leaves the device and never reaches the server.
• The private key signs the challenge. Your device produces a unique signature over that one challenge, tied to that one website domain.
• The server verifies and grants access. The website checks the signature against the stored public key. A match logs you in; no secret was ever transmitted.

The biometric or PIN unlocks the local key but is never sent anywhere, so a passkey combines possession of the device with a local check. That pairing is the same idea behind how multi-factor authentication combines verification factors, except the passkey folds both into one step. The unlock itself relies on the device sensor described in biometric authentication.

Why Are Passkeys Phishing-Resistant?

Passkeys resist phishing because no reusable secret is ever transmitted and the credential is bound to the real website domain. A password is a reusable secret you can be tricked into typing on a fake site; a passkey signature is unique to one challenge and one origin.

• Nothing reusable to steal: a fake login page captures no secret because none is sent.
• Bound to the real domain: the passkey will not sign for a lookalike or proxy site.
• One-time signatures: each response covers a single challenge, so a captured one cannot be replayed.
• Worthless breach loot: a hacked site database holds only public keys, which cannot log in alone.

How Do Passkeys Differ From Passwords?

A password is a shared secret you and the server both hold; a passkey keeps the private key on your device, so there is no secret to reuse, guess, or phish. That single change rewrites every weakness that passwords carry.

Password reuse and weak choices drive most account takeovers. A passkey removes the secret those attacks target instead of asking you to manage it more carefully, which is why it also shuts down credential stuffing: there is no leaked username-and-password pair to replay across other sites.

How Do Passkeys Compare to Two-Factor Authentication?

A passkey replaces both the password and a separate second factor by combining device possession with a local biometric or PIN check in one step. Traditional two-factor authentication keeps the password and stacks a code on top:

• Two-factor today: you enter a password, then a second factor such as a one-time SMS or app code.
• One-time codes are still phishable: a convincing fake site can ask for the code, and you can be tricked into typing it.
• A passkey is one action: unlocking the device proves possession plus local verification together.
• A passkey signature is not phishable: it binds to the real domain and transmits no code to capture.

A passkey delivers phishing-resistant strength comparable to a hardware security key while staying simpler to use, and it builds on the same FIDO2 base as the methods covered in what authentication is.

How Do Passkeys Sync Across Devices?

Synced passkeys replicate through an encrypted cloud keychain so the same passkey is available on your phone, tablet, and computer; device-bound passkeys stay on one device. Which kind you have decides how it travels and how you recover it:

• Synced passkeys: replicate through a provider keychain such as iCloud Keychain or Google Password Manager, protected by end-to-end encryption so the provider cannot read the private key.
• Device-bound passkeys: stay on one device, such as a hardware security key, and never sync, which gives the strongest isolation.
• Cross-device sign-in: when a passkey is not on the computer in front of you, your phone can authenticate the login instead.

Cross-device sign-in uses hybrid transport (caBLE): the computer shows a QR code, your phone scans it, and a Bluetooth proximity check confirms the two devices are physically close before the phone signs. The private key never leaves the phone, and the Bluetooth step blocks a remote attacker from completing the flow. Synced passkeys favor convenience and recovery; device-bound passkeys favor maximum isolation. A hardware security key such as a YubiKey is itself a device-bound passkey under FIDO2.

Which Companies Support Passkeys?

Google, Apple, and Microsoft support passkeys across their operating systems and browsers, and all three now push new accounts toward passkeys by default. The coordinated support means a passkey created on one platform can authenticate elsewhere through cross-device sign-in:

• Apple: passkeys since iOS 16 in 2022, synced through iCloud Keychain across iOS, iPadOS, and macOS.
• Google: passkeys are the new default for personal Google Accounts, with a prompt to create one, managed through Google Password Manager on Android and Chrome.
• Microsoft: passkeys are the default for new personal accounts (since May 2025) and supported through Windows Hello on Windows.
• Wider web: the FIDO Alliance coordinates the standard, and services including Amazon, PayPal, and GitHub accept passkeys for login.

Adoption has reached mainstream scale: the FIDO Alliance reported an estimated 5 billion passkeys in use worldwide on World Passkey Day 2026, with 75 percent of surveyed people having enabled a passkey on at least one account. Passwords are not gone yet, but the default for new sign-ins is shifting toward passkeys.

How Does a User Recover a Passkey?

You recover a passkey by restoring the synced keychain on a new device or by enrolling a fresh passkey through a backup method. The path depends on whether the passkey syncs:

• Synced passkeys return automatically when you sign in to the platform keychain on a replacement device.
• Account recovery re-enrolls a new passkey after identity verification when no device holds the key.
• Backup factors such as a second passkey on another device or a recovery code prevent lockout if the primary device is lost.
• Device-bound passkeys need a registered backup key, since a lost hardware key does not sync.

Registering a second passkey on a separate device removes the risk of lockout from a single lost device. Recovery planning matters most for device-bound passkeys, which carry no automatic cloud backup.

Passkey vs Password vs Two-Factor Comparison

The table below compares passkeys, passwords, and two-factor authentication across the attributes that decide real-world security.

Last Thoughts on Passkeys

A passkey replaces the password with a public and private key pair under the FIDO2 and WebAuthn standards, keeping the private key locked on your device and the public key on the server. The challenge-response signature proves who you are without sending a reusable secret, and origin binding makes the credential phishing-resistant by refusing to sign for any domain but the real one. In one tap, a passkey does the work of a password and a second factor, syncs through encrypted keychains, and works across Google, Apple, and Microsoft platforms.

With an estimated 5 billion passkeys now in use, passwordless login has moved from promise to mainstream, though most people still keep passwords for accounts that lack passkey support. Passkeys sit alongside the other defenses gathered on the hub for cybersecurity and authentication methods, which places them within the wider move away from shared secrets.

Key Takeaways:

• A passkey is a FIDO2 and WebAuthn credential built on a public and private key pair, not a typed secret.
• The private key stays on your device; the website stores only the public key.
• A challenge-response signature proves identity in one tap without sending anything reusable.
• Origin binding locks each passkey to the real domain, which is what makes it phishing-resistant.
• A passkey replaces both the password and a separate second factor at once.
• Synced passkeys travel through encrypted keychains; device-bound passkeys and hardware keys stay put for maximum isolation.
• Google, Apple, and Microsoft support passkeys and now default new accounts to them.

Frequently Asked Questions (FAQs)