DEV Community

Weather Clock Dash
Weather Clock Dash

Posted on

Firefox Passkeys: How They Work and How to Use Them

#webdev #firefox #privacy #security

Passkeys are a replacement for passwords using public-key cryptography. Firefox 122+ has built-in passkey support. Here's how it works and how to use it.

What Passkeys Are

A passkey is a pair of cryptographic keys:

  • Private key: Stored on your device (in a secure enclave or hardware security key), never leaves the device
  • Public key: Stored on the website

When you sign in, the website sends a challenge. Your device proves it has the private key by signing the challenge, without ever sending the key itself. No password is transmitted.

Benefits:

  • Phishing-resistant: The key is bound to the website's domain — a fake g00gle.com site can't steal your passkey for google.com
  • No password reuse: Each passkey is unique per website
  • No credential stuffing: Your credentials can't be leaked if the website is breached (only the public key is stored)
  • Biometric unlock: You authenticate with TouchID, Windows Hello, or a PIN — not a password

How Firefox Handles Passkeys

Firefox 122+ implements the WebAuthn API with passkey support. When you sign in to a site that supports passkeys:

  1. Site sends a WebAuthn authentication request
  2. Firefox shows a passkey dialog
  3. You authenticate with your device's biometric (TouchID on Mac, Windows Hello on Windows, screen lock on Linux)
  4. Firefox signs the challenge with your private key
  5. Site verifies the signature

Firefox stores passkeys in:

  • macOS: System Keychain (via macOS's credential storage)
  • Windows: Windows Hello credential store
  • Linux: Firefox's own storage (more limited)
  • Hardware keys: YubiKey, Titan Key, etc. (via FIDO2/CTAP)

Sync Across Devices

This is the current limitation: passkeys don't sync via Firefox Sync yet.

If you create a passkey on your desktop, your phone doesn't have it (unless you use a hardware key that works on both).

Options:

  • Hardware key (YubiKey): Works on all devices; carries your passkeys physically
  • Cross-device authentication: Use your phone to authenticate on desktop (via QR code + Bluetooth proximity) — standard passkey flow
  • Third-party password managers: Bitwarden, 1Password, and Dashlane can sync passkeys across browsers and devices

Mozilla has announced passkey sync is coming to Firefox Sync, but as of late 2024 it's not yet available.

Creating a Passkey in Firefox

On any site that supports passkeys (GitHub, Google, Apple ID, Microsoft, PayPal, Adobe, etc.):

  1. Go to your account security settings
  2. Look for "Passkeys" or "Security keys" or "Passwordless sign-in"
  3. Click "Add a passkey" or "Create passkey"
  4. Firefox shows the passkey creation dialog
  5. Authenticate with your device's biometric or PIN
  6. The passkey is created and stored

Firefox's passkey dialog shows:

  • Which device will store the passkey
  • An option to use a hardware security key instead
  • An option to use another device (QR code flow)

Using Passkeys to Sign In

When you sign in to a site with a passkey:

  1. Enter your username (or email) on the login page
  2. Firefox detects a stored passkey and prompts you to use it
  3. Authenticate with TouchID/Windows Hello
  4. Signed in — no password entry

Some sites support passkey auto-fill (similar to password auto-fill) where Firefox offers the passkey before you even start typing.

Managing Passkeys in Firefox

about:logins — Firefox's password manager. Passkeys created in Firefox appear here, labeled as passkeys (distinct from passwords).

You can delete passkeys from about:logins. This removes them from Firefox's storage. Note: the server still has the public key registered — you may need to delete it from your account settings on the site as well.

Hardware Security Keys

Firefox has excellent hardware security key support (FIDO2/WebAuthn via CTAP). YubiKeys, Titan Keys, and any FIDO2 key work.

Hardware keys are the most portable passkey solution — you plug in the key, tap it to authenticate, and it works on any device regardless of OS.

On Linux: hardware key USB access may require adding udev rules:

# For YubiKey on Linux
wget https://raw.githubusercontent.com/Yubico/libu2f-host/master/70-u2f.rules
sudo cp 70-u2f.rules /etc/udev/rules.d/
sudo udevadm control --reload-rules
Enter fullscreen mode Exit fullscreen mode

Passkey Support vs Password Support

Passkeys supplement, not replace, passwords in most site implementations currently. Sites usually let you sign in with either a passkey OR your password. The goal is to eventually make passkeys the primary method and deprecate passwords.

For now: if a site offers passkeys, setting one up is worth it. You can still use your password as a fallback.

Passkeys are the most significant improvement to web authentication in years. Firefox's support is solid for desktop use. The main gap — sync across devices — will improve as Mozilla adds passkey sync to Firefox Sync. For cross-device use now: a hardware key or a password manager that handles passkeys (Bitwarden supports them) is the practical path.

Top comments (0)