Passkeys vs FIDO2 Security Keys: What's the Difference?
Passkeys and FIDO2 hardware security keys are often discussed as competitors, but they are two forms of the same thing: FIDO2/WebAuthn credentials that authenticate you by proving possession of a private key bound to a website origin. The practical differences are portability and assurance. Synced passkeys live in a cloud keychain (Apple, Google, Microsoft, or a password manager) and follow the user across devices — best for broad workforce and consumer adoption. Hardware security keys are physical, device-bound authenticators that never sync — best for administrators, high-risk roles and environments that need the strongest device-bound assurance. Most organisations use both: passkeys for everyone, hardware keys for privileged accounts.
"Should we use passkeys or FIDO2 security keys?" is one of the most common identity questions right now, and it is slightly the wrong question — because they are not different standards. Both are FIDO2/WebAuthn credentials. Both authenticate you by proving you control a private key that is cryptographically bound to a specific website origin, which is exactly the property that makes both of them phishing-resistant. What actually differs is portability and assurance.
The one thing they share (and why it matters)
A FIDO2/WebAuthn credential — whether you call it a passkey or a security key — will only release for the origin it was registered with. Lure a user to a lookalike domain and the browser simply will not produce the credential. There is no code to read out, no push to approve, nothing for an adversary-in-the-middle kit to relay. That origin binding is the whole game, and both forms have it.
Where they differ
| Synced passkeys | Hardware security keys | |
|---|---|---|
| Form | Software credential in a cloud keychain | Physical token (USB/NFC/Bluetooth) |
| Portability | Syncs across the user's devices | Device-bound; does not sync |
| Assurance | Strong; also depends on the cloud account | Highest; key never leaves the device |
| Best for | General workforce, consumers, broad adoption | Administrators, privileged and high-risk roles |
| Cost / logistics | Effectively free; no hardware to ship | Per-key cost; provisioning and spares |
How to choose
- Everyone gets passkeys. They are the adoption engine: no hardware to ship, they sync, and they are dramatically more phishing-resistant than passwords or OTP.
- Privileged accounts get hardware keys. For administrators and anyone who can move money, change infrastructure or access crown-jewel data, the device-bound guarantee of a hardware key is worth the logistics.
- Register two per user. A platform passkey plus a roaming key removes the lockout problem and is itself a resilience control.
- Kill the fallback. Neither form helps if a phishable SMS/OTP path is still enabled on the same account.
The short answer
It is not passkeys versus keys — it is passkeys for the many, hardware keys for the few, both under one FIDO2/WebAuthn programme. For compliance-driven rollouts see FIDO2 for NIS2 and FIDO2 for DORA, and the full options assessment. Quantify where weak authentication sits today with the free Identity Risk tool →
Frequently asked questions
Are passkeys and FIDO2 keys the same? They are two forms of the same FIDO2/WebAuthn standard — both origin-bound and phishing-resistant. Passkeys usually sync via a cloud keychain; hardware keys are device-bound and do not sync.
Which is more secure? Hardware keys give the highest, device-bound assurance (ideal for admins); synced passkeys are strongly phishing-resistant and best for broad adoption.
Can we use both? Yes — passkeys for the workforce, hardware keys for privileged accounts, two authenticators per user.
Do device-bound passkeys exist? Yes — a passkey can be device-bound or synced; whether it syncs is a separate, often policy-controlled property.
Ready to practise the decisions these articles describe?
Run a free War Room →