What Are Passkeys and How Do They Work?

TL;DR

• A passkey is a sign-in credential stored on your phone, computer or security key, which you approve with a fingerprint, face scan or device PIN instead of typing a password [1].
• It uses a pair of cryptographic keys: the private key stays on your device and the website keeps only the public key [1].
• Passkeys resist phishing because they only work for the real site they were created for [2][3].
• Not every site supports them yet, so passwords remain as a fallback in many places.

How passkeys work #

When you create a passkey for a site, your device makes a key pair: a public key and a private key. The site stores the public key. The private key stays on your device [1].

To sign in, the site sends a challenge. Your device unlocks the private key with your usual screen lock (fingerprint, face or PIN) and uses it to sign the challenge. The site checks the signature with the public key. Your fingerprint or face data never leaves the device, and the site only learns that your device confirmed it was you [1].

Think of a lock and key: the website holds a lock that only your key opens, and you never hand the key over.

How passkeys differ from passwords #

Because there is nothing to type, there is nothing for a fake page to capture. The EFF notes that passkeys and security keys are phishing-resistant for this reason, unlike texted or app-generated codes that can be relayed [2].

Syncing and lost devices #

Passkeys can live on one device, or sync between your devices through a passkey provider such as a built-in credential manager from your phone or browser maker or a third-party password manager. Synced passkeys are end-to-end encrypted. A passkey that stays on a hardware security key is called device-bound [1].

If you lose a device, sign in to your account on another device and remove that device's passkey in the account's security settings. Google's help page, for example, describes this step, and also says you should create passkeys only on devices you own [3]. Keep another way to recover your account, since account recovery rules differ between services.

Getting started #

Look for "create a passkey" or "sign in with a passkey" in a site's security settings. You need a device with a screen lock turned on and a reasonably recent operating system and browser; Google lists examples such as Android 9, iOS 16, Windows 10 or macOS Ventura and later [3]. When signing in on a computer, you can often approve using your phone by scanning a QR code [3].

FAQ #

Are passkeys safer than passwords? #

They are generally stronger because there is no shared secret to steal and they cannot be handed to a fake site [1][2]. They still depend on you protecting your device and account recovery options.

Do passkeys replace two-factor authentication? #

A passkey can act like a password and a second factor in one step, since it combines something you have with a local unlock [2]. Many services still let you keep other methods too.

What if I lose my phone? #

Your passkeys may still be available on other synced devices. Remove the lost device from your account and set up passkeys again on your replacement [3].

Does the website see my fingerprint? #

No. The biometric check happens on your device, and the site only receives confirmation that it succeeded [1].

Sources #