passkeys

Passkeys are a standard-based form of user authentication designed to replace passwords. They rely on public-key cryptography and are implemented under the FIDO2 and WebAuthn specifications developed by the FIDO Alliance and the World Wide Web Consortium. Passkeys use platform authenticators, such as built-in biometric sensors or external security keys, and can be synchronized across devices.

Enrollment and login: When enrolling with a service, a new key pair is generated on the user's device. The private key never leaves the device, while the public key is stored by the service. During sign-in, the service issues a challenge that the device signs with the private key after user verification, proving possession of the credential.

Cross-device use and recovery: Passkeys can be backed up and synchronized through the device's cloud account (for example iCloud Keychain, Google Password Manager, or Windows account), enabling sign-in on other devices. Recovery may require account verification and, in some cases, additional backup methods.

Security and limitations: Passkeys are phishing resistant, because credentials are bound to the originating service and no secret is shared with the server beyond the public key. They reduce password-related attacks and data breaches. Limitations include dependence on device security, loss of devices, and uneven support across services.

Standards and ecosystem: The system is built on FIDO2, WebAuthn, and CTAP protocols, with broad support in modern browsers and operating systems. Major platforms offer built-in passkeys, such as Apple Passkeys, Windows Hello, and Android/Google devices. Adoption continues to grow, though not all services support passkeys yet.