Home / Knowledge hub / Passkeys
Knowledge hub
Passkeys
Phishing-resistant sign-in using a key on your device instead of a password.
What it means
A passkey is a sign-in credential made of a pair of cryptographic keys. The private key stays on the person's device or in their synced password manager, and your service keeps only the matching public key. Nothing secret is stored on your side.
To sign in, the device signs a challenge from your server after the person confirms with a fingerprint, face or PIN. There is no password to type, so there is nothing to guess, reuse or hand to a fake page.
Why it matters
Most account breaches start with a stolen or guessed password. A passkey is bound to your real website address, so a lookalike domain cannot collect a working sign-in. That removes much of phishing and credential stuffing for the accounts that use it.
The weak point moves to what surrounds it. If an attacker can still reach the password reset, an old sign-in option or a support agent who can be talked into a change, they go around the passkey. Strong sign-in is only as strong as the weakest way back in.
How it shows up
You meet passkeys as a "Sign in with a passkey" prompt, built on the WebAuthn standard. You store a public key and a credential identifier per device, and you need to decide what happens when someone loses a device or switches phones.
Mistakes repeat. Recovery falls back to an email link or an SMS code, which becomes the real lock. Old passwords are left working beside the new option. The server does not verify the signature, the challenge or the origin properly. Check each of those, not just the happy path.
Questions people ask
Passkeys, answered
Are passkeys the same as WebAuthn?
They are built on it. WebAuthn is the browser standard, and a passkey is a discoverable credential that works across devices, usually synced by a platform or password manager.
Can passkeys be phished?
Not in the usual way. The credential only answers to the website address it was created for, so a fake site gets nothing usable. An attacker can still target recovery or the person's device.
What if someone loses their phone?
Synced passkeys survive on the person's other devices. You still need a recovery route, and it must be as strong as the sign-in it replaces, or attackers will use it.
Do passkeys count as multi-factor authentication?
They can. A passkey proves possession of the device, and the unlock step adds something the person knows or is. Whether it satisfies a given rule depends on the standard you are measured against.
Do we have to remove passwords?
No, but any password left active remains the attack target. If you keep both, apply the same protections to the password route. That includes guarding any other password route to the same account.
Sources
Where this comes from
Related
Terms that sit next to this one
WebAuthn
The browser standard behind passkeys and hardware security keys.
MFA
A second proof beyond the password, usually a code or a hardware key.
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
Credential recovery
The ways a locked-out user gets back in, which are often the weakest door.
Public key cryptography
Encryption with a pair of keys: one shared openly, one kept private.
Is the way back in as strong?
Sign-in is tested end to end on the running app, including recovery and fallback routes, and each finding carries the request and response that proved it. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.