Passkey

A phishing-resistant login that replaces the password with your device and face or fingerprint.

Instead of typing a password, a person unlocks their phone or laptop with a fingerprint, face scan, or device PIN, and the device signs them in.

A credential built on FIDO2, the passwordless login standard from the FIDO (Fast Identity Online) Alliance, and the Web Authentication (WebAuthn) browser standard, in which a matched pair of cryptographic keys replaces the password. The private key stays with the person's device or passkey provider and is never shared with the website, while the public key is what the service stores.

A passkey sign-in works like this:

1. When the person creates a passkey, their device generates a key pair for that specific website and sends the public key to the service.
2. At sign-in, the service sends a random challenge.
3. The person unlocks the device with a fingerprint, face scan, or PIN, which happens locally and never sends the biometric to the service.
4. The device signs the challenge with the private key, and the service checks the signature with the public key.

Passkeys come in two types:

• Synced passkeys copy across the person's devices in encrypted form through a platform account, such as an Apple, Google, or Microsoft account.
• Device-bound passkeys stay on the device or hardware key where they were created and never move.

Passkeys sit next to terms that are easy to mix up:

• Password is a shared secret the person types and the service stores, while a passkey shares only a public key.
• Multi-factor authentication combines different kinds of proof, and a passkey unlocked with a fingerprint or face scan combines something you have with something you are in one step.
• One-time passcode is a code the person copies from a message, while a passkey needs no code at all.