What is passkey authentication?

Passkey authentication replaces passwords with phishing-resistant public-key credentials unlocked by a biometric, PIN, or device gesture.

Updated
July 13, 2026
Reviewed by
LoginID Identity Team

Direct answer

Passkey authentication verifies a user with a FIDO public-key credential instead of a password. The user approves sign-in with the same local method used to unlock a device, such as a biometric, PIN, or pattern. The private key stays protected by the user’s device or passkey provider, while the website verifies a signed challenge with the corresponding public key.

How does passkey authentication work?

Passkeys use two related ceremonies: registration and authentication. During registration, the authenticator creates a key pair scoped to the relying party. During authentication, it signs a fresh challenge that the service verifies with the stored public key. W3C WebAuthn Level 3

  1. 01

    Create a credential

    The website or app asks the user’s authenticator to create a public-key credential for its relying-party identity.

  2. 02

    Verify the user locally

    The authenticator asks for a biometric, PIN, pattern, or device gesture. That local factor unlocks the credential but is not sent to the website.

  3. 03

    Store only the public key

    The private key remains protected by the authenticator or passkey provider. The website associates the public key with the user’s account.

  4. 04

    Issue a fresh challenge at sign-in

    The website sends unpredictable challenge data to prevent replay.

  5. 05

    Sign and verify

    The authenticator signs the challenge and relying-party context. The website verifies the signature, origin, flags, and policy before creating the session.

Passkeys vs. passwords and one-time codes

Secret shared with serverPhishing-resistantUser actionCommon risk
PasswordYesNoType a remembered secretReuse, phishing, credential stuffing
SMS or email OTPTemporary codeNoCopy or type a codePhishing, interception, SIM swap
Authenticator-app OTPTemporary codeNoCopy or type a codeReal-time phishing and relay
PasskeyNo shared secretYesBiometric, PIN, or device gestureRecovery and device lifecycle must be designed well

Are passkeys the same as biometrics?

No. A biometric can be the local method that unlocks a passkey, but the passkey is the cryptographic credential used with the website. The biometric template stays on the device. The website receives a signed authentication result, not the fingerprint or face data. FIDO Alliance passkey FAQ

A PIN, pattern, or device password can unlock the same credential when biometrics are unavailable. The security boundary is the authenticator and its protected private key, not the biometric alone.

What is the difference between synced and device-bound passkeys?

Synced passkeys are securely available across devices through a passkey provider. They improve recovery and make password replacement practical across a user’s device ecosystem. Device-bound passkeys remain on one authenticator, such as a security key or managed device, and can suit environments that require stronger control over credential location.

Both models use FIDO credentials and phishing-resistant challenge-response authentication. The right choice depends on threat model, recovery needs, regulatory requirements, and user experience.

What standards power passkeys?

FIDO2 combines WebAuthn, the W3C browser and platform API for public-key credentials, with FIDO Client to Authenticator Protocols for communication with external or roaming authenticators. Passkey is the common cross-platform term for a FIDO credential used for passwordless authentication. FIDO user authentication specifications

What should teams plan before implementing passkeys?

  • Decide how users enroll their first passkey and how the account is initially verified.
  • Support multiple authenticators or recovery paths without falling back to weak, easily phished methods.
  • Choose user-verification and attestation policies appropriate to the risk.
  • Handle cross-device sign-in and account discovery deliberately.
  • Protect server-generated challenges against replay and verify origin, relying-party ID, signature, and authenticator flags.
  • Measure enrollment, sign-in success, recovery, abandonment, and fallback usage.

How LoginID uses passkeys

LoginID provides FIDO2-certified passkey authentication for passwordless login and digitally signed transaction authorization. In agentic workflows, the same passkey-centric model can verify the human behind an AI agent before a sensitive action proceeds, without giving the agent the user’s password or private key.

Related questions

Can a passkey be phished?
Passkeys are designed to resist phishing because the credential is scoped to the relying party. A counterfeit domain cannot use the passkey created for the legitimate domain.
Where is a passkey stored?
A passkey can be stored and synced by a platform or third-party passkey provider, or remain bound to a device or security key. The private key is protected by the authenticator or provider and is not stored by the relying-party server.
Can users sign in on a different device?
Yes. A synced passkey may already be available on the new device. Cross-device authentication can also let a nearby phone provide the passkey for a laptop or other client.
Are passkeys passwordless and multi-factor?
Passkeys are designed for passwordless authentication. When user verification is required, the flow combines possession of the authenticator with a local biometric or knowledge factor, although regulatory treatment can vary by jurisdiction and deployment.

Primary sources

  1. FIDO Alliance: Passkeys

    Passkey definition, security model, synced and device-bound credentials, local user verification, and deployment FAQ.

  2. FIDO Alliance: User Authentication Specifications

    FIDO2, WebAuthn, CTAP, authenticators, and phishing resistance.

  3. W3C Web Authentication Level 3

    Credential registration, authentication assertions, relying-party scoping, authenticators, and the security model.

  4. NIST SP 800-63-4

    Current digital identity guidance and assurance framework.

Continue exploring

AnswerWhat is AI agent authentication?AI agent authentication verifies the agent, the human it represents, and the cryptographic authority behind each consequential action.AnswerHow do you authenticate the human behind an AI agent?Authenticate the human behind an AI agent with a passkey, scoped delegation, action-bound proof, and verification at execution time.ComparisonAI agent authentication vs. authorizationAuthentication proves which agent and human are involved. Authorization decides what the agent may do, where, and under which limits.
Passkey provider guideSee what a passkey provider should supply beyond the browser API.Explore Provider comparisonCompare deployment approaches for fintech and payments.Explore Agent AuthenticationUse passkeys to verify the human behind an agentic request.Explore

Replace passwords with phishing-resistant authentication.

Give users a faster sign-in and keep reusable secrets out of servers, prompts, and agent workflows.

Start buildingBook a demo