Firefox Passkeys: Setup, Limitations, and Why You Should Start Using Them

Passwords are a 60-year-old technology being replaced. Passkeys use public-key cryptography — the private key never leaves your device, and phishing is structurally impossible. Here's how Firefox handles them.

How Passkeys Work

When you create a passkey on a site:

1. Your browser generates a key pair (public + private)
2. The private key is stored securely on your device (OS keychain)
3. The public key is sent to the server
4. When you log in, the server sends a challenge that only your private key can sign

The private key is never transmitted. Even if the site is phished (you're on evil-site.com instead of real-site.com), the passkey won't work — it's origin-bound.

Firefox's Passkey Support

Firefox added passkey support in version 122 (released January 2024).

What works:

• Creating passkeys on supported sites
• Using passkeys to log in
• Storage via the OS credential manager (Windows Hello, macOS Keychain, Linux secret service)
• Cross-device passkeys via your phone (using CTAP2/Bluetooth protocol)

What's limited vs Chrome:

• No Google Password Manager integration (that's Chrome-specific)
• No Firefox-native passkey sync across devices (yet)
• The cross-device Bluetooth flow works but is less polished

Testing It Yourself

Sites with passkey support (2024-2025):

• GitHub.com: Settings → Password and authentication → Passkeys
• Google accounts: Account security
• Microsoft accounts: Sign in → Security → Passkey
• Bitwarden (with Firefox extension): can store and autofill passkeys

Try on GitHub: Create a passkey, log out, and log back in. Notice you don't need your password.

Checking Firefox's WebAuthn Capabilities

In Firefox's browser console:

// Check if platform authenticator available
navigator.credentials.isUserVerifyingPlatformAuthenticatorAvailable()
  .then(result => console.log('Platform auth available:', result));

On a machine with Windows Hello or Touch ID, this returns true. Without hardware authenticator, returns false but cross-device/security key passkeys still work.

The Sync Gap

This is Firefox's current limitation: passkeys aren't synced via Firefox Sync.

On Chrome, passkeys sync through your Google account. On Apple devices, through iCloud Keychain. On Firefox, they live in your OS credential store — which is local.

Workarounds:

1. Bitwarden (and 1Password, Dashlane) can store passkeys and sync them cross-platform. Install the Firefox extension and let Bitwarden handle passkey creation.
2. Cross-device flow: If you have an Android phone with Chrome, your passkeys sync via Google. You can authenticate in Firefox on desktop using Bluetooth connection to your phone.
3. Security key (e.g., YubiKey): Roaming authenticators work in Firefox. A YubiKey stores passkeys and works wherever you plug it in.

Security Properties

Compared to passwords:

• No phishing: Origin-binding means passkeys won't work on lookalike domains
• No credential stuffing: Nothing to breach from the server side
• No reuse: Each passkey is site-specific by design
• Biometrics are local: Your fingerprint/face never leaves your device

Compared to password + authenticator app (TOTP):

• Passkeys are stronger (TOTP can still be phished in real-time MITM)
• Less friction (no typing 6-digit codes)
• Harder to recover if you lose all devices (passwords + TOTP backup codes are still useful to have)

about:config Settings

Firefox doesn't expose much passkey config in the UI, but a few flags:

security.webauth.webauthn                 → true (enable WebAuthn)
security.webauth.webauthn_testing_allow_list_all  → false (don't change)

The main setting is just ensuring WebAuthn is enabled (it is by default).

The Recommendation

For Firefox users in 2025:

1. Create passkeys on major accounts (GitHub, Google, Microsoft) for yourself
2. Install Bitwarden or 1Password extension if you want cross-device sync
3. Keep a hardware security key (YubiKey 5) as a backup for your most critical accounts
4. Expect native Firefox Sync passkey support to arrive — it's on Mozilla's roadmap

The privacy advantage of passkeys matches Firefox's user base well: biometric data stays local, no third-party auth providers track your logins, and origin-binding prevents the most common attack vectors.