•
•
•
•
•
•
•
Public-key cryptography, phishing resistance, syncing across devices and how to start using passkeys
Passwords are the weak link in online security. People reuse them, forget them and type them into fake websites. Passkeys are designed to replace passwords with something both more secure and easier to use. Major platforms including Apple, Google and Microsoft support them, and a growing number of banks, e-commerce sites and apps offer passkey login.
A passkey is a digital credential based on public-key cryptography. When you create a passkey for a website or app, your device generates a pair of keys:
To sign in, the website sends a challenge. Your device signs it with the private key after you unlock it using your fingerprint, face or device PIN. The website verifies the signature with the public key. No password is typed or transmitted.
Passkeys are built on open standards from the FIDO Alliance and the W3C, specifically FIDO2, WebAuthn and CTAP.
| Threat | Passwords | Passkeys |
|---|---|---|
| Phishing sites | Users can be tricked into typing passwords | Passkeys only work on the genuine site they were created for |
| Data breaches | Stolen password databases can be cracked | Sites store only public keys, useless to attackers |
| Password reuse | Common | Each passkey is unique per site |
| Weak passwords | Common | Not applicable |
| OTP interception | SMS OTPs can be intercepted or socially engineered | No OTP needed |
The biggest advantage is phishing resistance: because a passkey is cryptographically bound to the website's domain, a lookalike fake site cannot use it.
No. Biometrics only unlock the passkey locally on your device. The website never receives your fingerprint or face data.
You can also sign in on a new device, such as a laptop, by scanning a QR code with your phone, which uses Bluetooth proximity to confirm you are nearby.
navigator.credentials.create() and navigator.credentials.get()) or a trusted authentication library.A passkey combines something you have (the device) with something you are or know (biometric or PIN), so it provides strong multi-factor protection in a single step.
If your passkeys are synced, they are available on your other signed-in devices. Otherwise, use the service's account recovery process.
No security is perfect, but passkeys eliminate the most common attacks: phishing, password reuse and credential stuffing.
Passkeys make logging in faster and far more secure. As more services adopt them, users should enable passkeys wherever available and keep devices protected with a strong screen lock.