The latest articles on DEV Community by Vault Security AI (@vault_security_ai). https://dev.to/vault_security_ai https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4181554%2F488cd1da-41a9-4ab6-8ca3-58d993fc58f7.png https://dev.to/vault_security_ai en Vault Security AI Tue, 13 Oct 2026 08:27:49 +0000 https://dev.to/vault_security_ai/passkeys-explained-without-the-jargon-3cko https://dev.to/vault_security_ai/passkeys-explained-without-the-jargon-3cko <p>You’ve probably seen a website ask, “Would you like to create a passkey?”<br> It sounds like another password to manage. It actually works quite differently.</p> <h2> What happens when you create one? </h2> <p>Your device or password manager creates a pair of cryptographic keys:</p> <ul> <li>A public key, which the website stores.</li> <li>A private key, which your authenticator protects.</li> </ul> <p>When you sign in, the website sends a challenge. Your authenticator signs it with the private key, and the website checks the response using the public key. You usually approve this with your fingerprint, face, or device PIN.</p> <p>There’s no password to type or send to the website. MDN explains the process here.</p> <h2> Why are passkeys harder to phish? </h2> <p>A password works wherever you type it—including a convincing fake login page. Passkeys are tied to the service they were created for. A lookalike website can’t simply ask your browser to use another website’s passkey.<br> That binding is what makes passkeys phishing-resistant. Your fingerprint or face data also stays on your device; the website receives cryptographic proof, not your biometric data.</p> <h2> What if you lose your phone? </h2> <p>It depends on where you saved the passkey.<br> Some passkeys sync through a credential provider, allowing you to use them across supported devices. Others stay on a specific device or hardware security key.<br> Before relying on one, check how your provider handles recovery and whether you can register another authenticator. FIDO’s guide covers these options.</p> <h2> A note for developers </h2> <p>Adding passkeys also means thinking through account recovery. A strong sign-in method won’t help much if an attacker can easily bypass it through a weak reset process.<br> Use an established WebAuthn library, validate authentication responses on the server, and test what happens when someone loses access to their device. Google recommends using a library rather than implementing server-side registration from scratch.<br> Passkeys won’t stop every scam. But they remove a familiar problem: someone tricking you into handing over a reusable password.</p> <p><strong>Have you started using passkeys, or does the recovery process still make you hesitate?</strong></p> security webdev beginners authentication