What Is a Passkey? How Passkeys Work and Whether They Are Safe
A passkey is a way to sign in without typing a password. It is a credential based on FIDO standards: your device holds a private key, the website holds the matching public key, and you approve each sign-in with your fingerprint, face or device PIN. Because each passkey only works for the site it was created for, passkeys resist phishing in a way passwords cannot.
TL;DRThe short version
5 points
- A passkey is a sign-in credential based on FIDO standards. It replaces a password with a cryptographic key pair: the private key stays on your device or with your passkey provider, and the website only stores a public key.
- You unlock it with the same method you use for your device, such as a fingerprint, face or PIN. The FIDO Alliance says biometric data stays on the device and is not sent to the website.
- Passkeys are phishing-resistant because each one is tied to one website. A fake site on a different domain cannot use it.
- Passkeys can sync across your devices through a provider, or stay on a single device. Syncing helps recovery but moves some trust to the provider and the account recovery process.
- The weak point is usually the fallback. If a site still allows a password or an SMS code to recover an account, an attacker can use that instead.
How a passkey works
- Registration. When you add a passkey to a site, your device creates a new key pair for that site. The public key goes to the site. The private key stays on your device or with your passkey provider.
- Sign-in. The site sends a one-time challenge. Your device asks you to unlock (fingerprint, face or PIN), then signs the challenge with the private key.
- Verification. The site checks the signature with the public key. Nothing secret was typed or sent, so there is nothing to replay later.
The biometric check happens locally. The FIDO Alliance states that biometric data is not sent to the website, which only learns that the check succeeded.
Why passkeys resist phishing
Passkeys are built on WebAuthn, a W3C web standard (Level 2 became a W3C Recommendation on 8 April 2021), and CTAP, the protocol between browser and authenticator. Together they are known as FIDO2. WebAuthn scopes each credential to a Relying Party ID, normally the site's domain, and the browser's origin is included in what the authenticator signs. A lookalike domain therefore cannot ask for, or use, the real site's passkey, and the user has no code to type into a fake page. Compare that with SMS codes, authenticator-app codes and push approvals, which an attacker-in-the-middle page can relay.
Passkeys, passwords, password managers and MFA
| Method | Secret sent to site? | Phishable? |
|---|---|---|
| Password | Yes, every time | Yes |
| Password + SMS or app code | Yes, plus a code | Yes, by a relaying fake site |
| Password manager | Yes, but unique per site | Reduced, since it fills only on the matching site, but the password still exists |
| Passkey | No, only a signature | Designed to resist phishing |
A password manager and a passkey work together: many password managers can store and sync passkeys. See the longer comparison in Passkeys vs FIDO2 Security Keys.
Synced or device-bound
The FIDO Alliance describes two storage models. Synced passkeys are copied across a user's devices by a passkey provider, so losing one device does not lose access. Device-bound passkeys stay on a single device or hardware key. Synced passkeys are easier for everyone; device-bound keys give tighter control for privileged or regulated accounts. Syncing moves some trust to the provider account, so protect that account strongly.
Risks to plan for
- Fallbacks. A passkey does not help if the site still lets an attacker sign in with a password or recover the account by SMS. Remove or harden those paths.
- Recovery. Decide in advance how a user who lost every device gets back in, and how you verify it is really them.
- Provider account. For synced passkeys, the provider account is the new crown jewel.
- Unlocked devices. Anyone who can unlock the device can use its passkeys, so use a strong device PIN.
- Malware on the device can still act while you are signed in.
Try the decisions yourself
If you run identity for an organisation, work through realistic rollout scenarios in the Passkey & WebAuthn Lab, choose factors with the Phishing-Resistant MFA Planner, and compare options in the Hardware Token Chooser. To see how an MFA bypass actually works, try the MFA Bypass Lab.
Frequently asked questions
What is a passkey?
A passkey is a sign-in credential based on FIDO standards that replaces a password. It is a cryptographic key pair created for one website. The private key stays with you, on your device or with your passkey provider, and the website keeps only the public key. You approve a sign-in with your device unlock, such as a fingerprint, face or PIN.
Are passkeys safe?
Passkeys are designed to resist phishing and leaked databases. A site breach exposes only public keys, which are useless to an attacker, and a lookalike site cannot use a passkey made for the real one. They are not a cure for everything: a stolen unlocked device, a compromised passkey provider account, or a weak account recovery path can still let an attacker in.
What is the difference between a passkey and a password?
A password is a shared secret that you type and the site stores in hashed form, so it can be phished, guessed, reused or leaked. A passkey is a key pair: nothing secret is typed or sent to the site, and each passkey works only for the site it was made for.
Do passkeys replace two-factor authentication?
For sign-in, a passkey usually does both jobs in one step. It proves you hold the device or provider account that has the key, and the device unlock (fingerprint, face or PIN) proves you are the person using it. A site may still ask for extra checks on risky actions.
What happens if I lose my phone?
If your passkeys are synced through a provider such as your phone maker or a password manager, signing in to that provider account on a new device restores them. Device-bound passkeys, such as those on a hardware security key, are not restored, so keep a second key or another approved recovery method. Recovery is the part of a passkey rollout most worth planning.
What is the difference between a passkey and a security key?
A hardware security key can hold a device-bound passkey that never leaves the key. Many passkeys instead live on phones, computers or password managers and can sync. Both rely on the same FIDO2 standards (WebAuthn and CTAP). Security keys suit high-risk accounts, while synced passkeys suit most people. Our comparison post covers the trade-offs.
Can I use a passkey on a computer that is not mine?
Often yes. Cross-device sign-in lets you use a passkey on your phone to sign in on another device: you scan a QR code, and Bluetooth is used to confirm the two devices are close together. Nothing is installed on the other computer.
How do companies roll out passkeys?
Typically in stages: pick which accounts and apps support WebAuthn, decide between synced and device-bound passkeys by risk, remove phishable fallbacks for those accounts, and design recovery before enforcing. The MFA planner and passkey lab linked below help with those decisions.
Sources
Checked against both sources on 3 November 2026.