Passkeys

Passkeys are passwordless, phishing-resistant FIDO2 login credentials synced across devices. Learn how they work and differ from security keys.

A passkey is a consumer-friendly implementation of FIDO2/passkeys: a public-private key pair created and stored on a device, unlocked with a PIN or biometric such as a fingerprint or face scan, and used to log in to a website or app without typing a password. The private key is never disclosed to the relying party - a synced passkey is copied between a user's own devices, but only end-to-end encrypted through the platform's keychain - and the biometric or PIN never leaves the device - only a cryptographic proof that the correct key was used.

Passkeys come in two forms. Device-bound passkeys stay on a single piece of hardware, similar to a traditional FIDO2 security key. Synced passkeys are backed up and shared across a user's devices through a platform's encrypted cloud account, such as Apple's iCloud Keychain or Google Password Manager, so a passkey created on a phone also works on a laptop. This syncing is what has made passkeys mainstream: it removes the old FIDO2 pain point of losing access when a single device breaks, while keeping the underlying strong authentication and phishing resistance of the WebAuthn standard.