You’ve probably seen a website ask, “Would you like to create a passkey?”
It sounds like another password to manage. It actually works quite differently.
What happens when you create one?
Your device or password manager creates a pair of cryptographic keys:
- A public key, which the website stores.
- A private key, which your authenticator protects.
When you sign in, the website sends a challenge. Your authenticator signs it with the private key, and the website checks the response using the public key. You usually approve this with your fingerprint, face, or device PIN.
There’s no password to type or send to the website. MDN explains the process here.
Why are passkeys harder to phish?
A password works wherever you type it—including a convincing fake login page. Passkeys are tied to the service they were created for. A lookalike website can’t simply ask your browser to use another website’s passkey.
That binding is what makes passkeys phishing-resistant. Your fingerprint or face data also stays on your device; the website receives cryptographic proof, not your biometric data.
What if you lose your phone?
It depends on where you saved the passkey.
Some passkeys sync through a credential provider, allowing you to use them across supported devices. Others stay on a specific device or hardware security key.
Before relying on one, check how your provider handles recovery and whether you can register another authenticator. FIDO’s guide covers these options.
A note for developers
Adding passkeys also means thinking through account recovery. A strong sign-in method won’t help much if an attacker can easily bypass it through a weak reset process.
Use an established WebAuthn library, validate authentication responses on the server, and test what happens when someone loses access to their device. Google recommends using a library rather than implementing server-side registration from scratch.
Passkeys won’t stop every scam. But they remove a familiar problem: someone tricking you into handing over a reusable password.
Have you started using passkeys, or does the recovery process still make you hesitate?
Top comments (0)