What is Passkey?
A passkey is a FIDO2/WebAuthn credential stored on a user's device that replaces passwords with public-key cryptography for authentication.
A passkey is a discoverable FIDO2 credential, as defined by the FIDO Alliance and the W3C WebAuthn specification (recommendation-level since 2019). It replaces a traditional password with a key pair: the private key never leaves the user's device (phone, laptop, or hardware security key), and the corresponding public key is registered with the relying party (a website or application). Authentication uses a challenge-response handshake signed by the private key, validated by the public key on the server. Because the private key never transits the network and is never stored server-side, passkeys resist phishing, credential theft, and replay attacks.
The process begins when a user creates a passkey during registration. The relying party issues a challenge, and the user's authenticator (e.g., platform attestation like Apple's Secure Enclave or Android's Trusted Execution Environment) generates a new key pair. The public key plus an attestation statement are sent to the server; the private key stays locked in the authenticator. On subsequent login, the server sends a challenge; the authenticator signs it with the private key, and the server verifies with the stored public key. User verification (biometric or PIN) unlocks the authenticator for each use, binding the gesture to the cryptographic operation.
Passkeys sit above WebAuthn as the user-facing concept, while WebAuthn defines the protocol and CTAP2 handles communication with external authenticators. They are designed to be synced across a user's devices via cloud keychains (e.g., iCloud Keychain, Google Password Manager) so the credential is portable within an ecosystem without exposing the private key in transit. Major platform support arrived in 2022-2023: Apple (iOS 16, macOS Ventura), Google (Android 9+, Chrome 109), and Microsoft (Windows 11, Edge 109).
Key facts
- Passkeys use asymmetric cryptography; the private key remains on the user's device.
- They are resistant to phishing because the origin is bound to the key pair during attestation.
- FIDO2 / WebAuthn is the underlying standard; passkey is the consumer-facing term.
- User verification (biometric or PIN) is required each time a passkey is used.
- Synced passkeys allow recovery across devices within an ecosystem, not via server-side secrets.
How it works in practice
Related terms
References
More in Security
2FA
Two-factor authentication (2FA) is a security method that requires a user to present two distinct types of evidence to verify their identity, typically a password and a time-based one-time code from an authenticator app or hardware key.
Bot Management
Bot management detects automated web traffic and distinguishes it from human users, using behavioral fingerprinting and other signals to block malicious bots while allowing benign ones.
Credential Stuffing
Credential stuffing is a cyberattack in which automated tools use username-password pairs leaked from one site to try logging into other sites, exploiting password reuse.
DDoS
A DDoS (Distributed Denial of Service) attack overwhelms a target server, service, or network with massive traffic from many compromised computers, making it unavailable to legitimate users.
DDoS Scrubbing
DDoS scrubbing diverts attack traffic to a specialized filtering facility that removes malicious packets and forwards only legitimate traffic to the target network.
Firewall
A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.
IDS
An Intrusion Detection System (IDS) monitors network traffic or host activity for signs of malicious behavior or policy violations and generates alerts for security personnel.
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic inline and actively blocks malicious packets before they reach their target.
OAuth 2.0
OAuth 2.0 is an authorization framework that allows a user to grant a third-party application limited access to their resources on another service without revealing their password.
OpenID Connect
OpenID Connect (OIDC) is an identity authentication layer built on OAuth 2.0 that provides a signed ID token containing verified user identity claims.