How does a passkey work?
Passkeys use two related ceremonies: registration and authentication. During registration, the authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges. creates a key pair scoped to the relying partyThe website or application that requests authentication and verifies the signed result.. During authentication, it signs a fresh challenge that the service verifies with the stored public key. W3C WebAuthn Level 3
- 01
Create a credential
The website or app asks the user’s authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges. to create a public-key credential for its relying-partyA modifier referring to the website or application that requests authentication and verifies the signed result. identity.
- 02
Verify the user locally
The authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges. asks for a biometric, PIN, pattern, or device gesture. That local factor unlocks the credential but is not sent to the website.
- 03
Store public credential data
The private key remains protected by the authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges. or passkey provider. The website stores the public key, credential identifier, and related metadata with the user’s account.
- 04
Issue a fresh challenge at sign-in
The website sends unpredictable challenge data to prevent replay.
- 05
Sign and verify
The authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges. signs the challenge and relying-partyA modifier referring to the website or application that requests authentication and verifies the signed result. context. The website verifies the signature, origin, flags, and policy before creating the session.
Passkeys vs. passwords and one-time codes
| Reusable shared secret | Phishing-resistant | User action | Common risk | |
|---|---|---|---|---|
| Password | Yes | No | Type a remembered secret | Reuse, phishing, credential stuffing |
| SMS or email OTP | No; one-time code validated by the service | No | Copy or type a code | Phishing, interception, SIM swap |
| Authenticator-app OTP | Yes; a TOTP seed | No | Copy or type a code | Real-time phishing and relay |
| Passkey | No shared secret | Yes | Biometric, PIN, or device gesture | Recovery and device lifecycle must be designed well |
Are passkeys the same as biometrics?
No. A biometric can be the local method that unlocks a passkey, but the passkey is the cryptographic credential used with the website. The biometric template stays on the device. The website receives a signed authentication result, not the fingerprint or face data. FIDO Alliance passkey FAQ
A PIN, pattern, or device password can unlock the same credential when biometrics are unavailable. The security boundary is the authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges. and its protected private key, not the biometric alone.
What is the difference between synced and device-bound passkeys?
synced passkeyA passkey made available across a user’s devices through a passkey provider’s protected synchronization service.s are securely available across devices through a passkey provider. They improve recovery and make password replacement practical across a user’s device ecosystem. device-bound passkeyA passkey whose private key remains on one authenticator, such as a managed device or hardware security key.s remain on one authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges., such as a security key or managed device, and can suit environments that require stronger control over credential location.
Both models use FIDOFast Identity Online. FIDO Alliance develops open authentication standards that replace shared secrets with public-key cryptography. credentials and phishing-resistant challenge-response authentication. The right choice depends on threat model, recovery needs, regulatory requirements, and user experience.
What standards power passkeys?
FIDO2The combined WebAuthn and CTAP standards used for phishing-resistant public-key authentication on the web and across authenticators. combines WebAuthnThe W3C browser and platform API that lets websites create and use public-key credentials with authenticators., the W3C browser and platform API for public-key credentials, with FIDOFast Identity Online. FIDO Alliance develops open authentication standards that replace shared secrets with public-key cryptography. Client to authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges. Protocols for communication with external or roaming authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges.s. Passkey is the common cross-platform term for a FIDOFast Identity Online. FIDO Alliance develops open authentication standards that replace shared secrets with public-key cryptography. credential used for passwordless authentication. FIDO user authentication specifications
What should teams plan before implementing passkeys?
- Decide how users enroll their first passkey and how the account is initially verified.
- Support multiple authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges.s or recovery paths without falling back to weak, easily phished methods.
- Choose user-verification and attestationCryptographic evidence about an authenticator or credential that a relying party can evaluate during registration. policies appropriate to the risk.
- Handle cross-device sign-in and account discovery deliberately.
- Protect server-generated challenges against replay and verify origin, relying-partyA modifier referring to the website or application that requests authentication and verifies the signed result. ID, signature, and authenticatorThe device or software component that protects the private key, verifies the user locally, and signs authentication challenges. flags.
- Measure enrollment, sign-in success, recovery, abandonment, and fallback usage.
How LoginID uses passkeys
LoginID provides FIDO2The combined WebAuthn and CTAP standards used for phishing-resistant public-key authentication on the web and across authenticators.-certified passkey authentication for passwordless login and digitally signed transaction authorization. In agentic workflows, the same passkey-centric model can verify the human behind an AI agent before a sensitive action proceeds, without giving the agent the user’s password or private key.