Passkeys vs FIDO2 Security Keys: What's the Difference?
TL;DR · the short version
Passkeys and FIDO2 hardware security keys are two forms of the same thing: FIDO2/WebAuthn credentials that authenticate by proving possession of a private key bound to a website origin. The difference is portability and assurance. Synced passkeys live in a cloud keychain (Apple, Google, Microsoft, or a password manager) and follow the user across devices — best for broad workforce and consumer adoption. Hardware keys are device-bound and never sync — best for admins and high-risk roles. Most organisations use both.
"Should we use passkeys or FIDO2 security keys?" is one of the most common identity questions right now, and it is slightly the wrong question — because they are not different standards. Both are FIDO2/WebAuthn credentials. Both authenticate you by proving you control a private key that is cryptographically bound to a specific website origin, which is exactly the property that makes both of them phishing-resistant. What actually differs is portability and assurance.
The one thing they share (and why it matters)
A FIDO2/WebAuthn credential — whether you call it a passkey or a security key — will only release for the origin it was registered with. Lure a user to a lookalike domain and the browser simply will not produce the credential. There is no code to read out, no push to approve, nothing for an adversary-in-the-middle kit to relay. That origin binding is the whole game, and both forms have it.
Where they differ
| Synced passkeys | Hardware security keys | |
|---|---|---|
| Form | Software credential in a cloud keychain | Physical token (USB/NFC/Bluetooth) |
| Portability | Syncs across the user's devices | Device-bound; does not sync |
| Assurance | Strong; also depends on the cloud account | Highest; key never leaves the device |
| Best for | General workforce, consumers, broad adoption | Administrators, privileged and high-risk roles |
| Cost / logistics | Effectively free; no hardware to ship | Per-key cost; provisioning and spares |
How to choose
- Everyone gets passkeys. They are the adoption engine: no hardware to ship, they sync, and they are dramatically more phishing-resistant than passwords or OTP.
- Privileged accounts get hardware keys. For administrators and anyone who can move money, change infrastructure or access crown-jewel data, the device-bound guarantee of a hardware key is worth the logistics.
- Register two per user. A platform passkey plus a roaming key removes the lockout problem and is itself a resilience control.
- Kill the fallback. Neither form helps if a phishable SMS/OTP path is still enabled on the same account.
The short answer
It is not passkeys versus keys — it is passkeys for the many, hardware keys for the few, both under one FIDO2/WebAuthn programme. For compliance-driven rollouts see FIDO2 for NIS2 and FIDO2 for DORA, and the full workforce benefits and readiness. Quantify where weak authentication sits today with the Identity Risk tool →
Frequently asked questions
Are passkeys more secure than 2FA? Passkeys are a stronger form of two-factor / passwordless authentication: because they are FIDO2/WebAuthn credentials bound to a website origin, they are phishing-resistant, unlike SMS codes or TOTP apps a user can be tricked into entering on a fake site. They raise the bar over traditional 2FA rather than simply adding a factor.
What is a Wi-Fi passkey? A Wi-Fi passkey is simply the password for a wireless network — an unrelated use of the word. It has nothing to do with FIDO2/WebAuthn passkeys, which are cryptographic login credentials for websites and apps.
What is FIDO2 WebAuthn? FIDO2 is the standard that enables passwordless, phishing-resistant authentication; WebAuthn is its browser/web API, paired with CTAP for talking to authenticators. Both passkeys and hardware security keys are implementations of FIDO2/WebAuthn credentials.
What are the downsides of passwordless authentication? The main trade-offs are account recovery (you need a robust fallback if a device or key is lost), device or key loss, and legacy systems that do not speak WebAuthn. Registering a backup authenticator and planning recovery mitigate most of these.
Are passkeys and FIDO2 keys the same? They are two forms of the same FIDO2/WebAuthn standard — both origin-bound and phishing-resistant. Passkeys usually sync via a cloud keychain; hardware keys are device-bound and do not sync.
Which is more secure? Hardware keys give the highest, device-bound assurance (ideal for admins); synced passkeys are strongly phishing-resistant and best for broad adoption.
Can we use both? Yes — passkeys for the workforce, hardware keys for privileged accounts, two authenticators per user.
Do device-bound passkeys exist? Yes — a passkey can be device-bound or synced; whether it syncs is a separate, often policy-controlled property.
Frequently asked questions
Are passkeys and FIDO2 keys the same thing?
They are two implementations of the same standard. Both are FIDO2/WebAuthn credentials that authenticate by proving control of a private key cryptographically bound to a specific website origin, which is what makes both phishing-resistant. The difference is form and portability: passkeys are typically synced across a user's devices through a cloud keychain, while hardware security keys are physical, device-bound tokens that do not sync.