Passkeys.

What is a passkey?

FIDO Alliance defines a passkey as an authentication credential based on FIDO standards. It can be stored on your phone or computer, or in a hardware security key. Passkeys are meant to replace passwords.

How do passkeys work?

You approve a sign-in the same way you open your device. That can be a fingerprint, a PIN or a pattern. FIDO Alliance says passkeys build on the FIDO2 standards, including WebAuthn and CTAP, and use standard public key cryptography.

Public key cryptography uses a pair of linked keys instead of a shared secret.

FIDO Alliance also says passkeys can be securely synced across a user’s devices by a passkey provider, such as a browser, an operating system or a third-party app.

Why are passkeys phishing-resistant?

FIDO Alliance says passkeys use standard public key cryptography to provide phishing-resistant authentication. The UK National Cyber Security Centre (NCSC) says passkeys cryptographically bind authentication to the legitimate service. It also says traditional multi-factor authentication stays vulnerable to phishing because secrets or approvals can be observed and relayed during a live session.

CISA says some forms of MFA are vulnerable to phishing, push bombing, SS7 weaknesses and SIM swap attacks. It says FIDO/WebAuthn authentication is resistant to phishing, and that push bombing, SS7 and SIM swap attacks are not applicable to it.

What does a passkey look like in practice?

This is a simple illustration. A site offers a passkey. You create it once on your phone. Later, the site asks you to sign in, and your phone asks for your fingerprint or PIN. You never type a password.

What do official bodies recommend?

The NCSC says it will begin recommending passkeys wherever a service supports them, and two-step verification where it does not.

CISA calls phishing-resistant MFA the gold standard and strongly urges organizations to adopt it. It says that while any form of MFA is better than none, some forms are vulnerable to phishing, push bombing, SS7 and SIM swap attacks.

Is a passkey the same as a password?

No. A password is a secret that you type and that a site can store. A passkey uses a key pair, and you approve it with your device fingerprint, PIN or pattern.

Is a passkey multi-factor authentication?

It can be. The NCSC says FIDO2 credentials combine something the user has, the cryptographic key, with something they are or know when user verification takes place. That makes them multi-factor authentication. CISA also says FIDO authentication can include other factors, such as biometrics or PIN codes.

Where are passkeys stored?

CISA says WebAuthn authenticators can be separate physical tokens, called roaming authenticators, connected over USB or near-field communication. They can also be built into laptops or mobile devices, called platform authenticators. FIDO Alliance adds that a passkey can live on a phone, a computer or a hardware security key.

Related terms

Related terms include multi-factor authentication, password managers and account takeover.