Glossary
Passkeys are phishing-resistant login credentials, built on the FIDO2 and WebAuthn standards, that replace passwords with a public/private key pair, the private key stays on the user’s device and is unlocked by a biometric or device PIN. They are the leading technology for true passwordless authentication at consumer scale.
Backed by Apple, Google, Microsoft, and the FIDO Alliance, passkeys have moved from promise to mainstream, and they’re the single most important development in consumer authentication in years.
At registration, the user’s device generates a cryptographic key pair. The private key never leaves the device (it’s stored in secure hardware and unlocked only by the user’s biometric or PIN) while the service keeps just the public key. To log in, the service sends a challenge; the device signs it with the private key; the service verifies the signature with the public key. No shared secret is ever transmitted or stored, so there’s nothing to phish, intercept, or steal from a breached database.
This is the property that matters most. A passkey is cryptographically bound to the specific site (the relying party) it was created for. If a user lands on a lookalike phishing site, the passkey simply won’t work there, the browser won’t produce a signature for the wrong origin. That single design choice defeats the phishing, credential stuffing, and real-time proxy attacks that plague passwords and even OTP-based MFA.
Passkeys are usually faster than passwords: a glance or a fingerprint instead of typing and remembering a string. They sync across a user’s devices through platform ecosystems, and they work across devices via secure proximity flows. For customers, the friction of passwords (and the resets that follow forgetting them) largely disappears.
Passkeys are a major improvement, not a complete solution on their own, a distinction worth being honest about. The hard parts are lifecycle: registration, account recovery, device loss, and fallback. If a user loses the device holding their passkey, the recovery path must be secure, or it becomes the weak link attackers target through social engineering. Cross-platform portability and enterprise deployment add wrinkles. This is why leading deployments pair passkeys with a risk engine and device intelligence, securing the fallback and recovery flows, and detecting social-engineering attempts around them, so the gaps around the passkey are covered as well as the passkey itself.
| Password | Password + OTP/push MFA | Passkey | |
|---|---|---|---|
| Shared secret to steal | Yes | Yes (password + code) | No |
| Phishing-resistant | No | No (real-time phishable) | Yes (origin-bound) |
| Works if a site is breached | Reusable if leaked | Password still leaks | Only a public key is stored |
| User effort | Type + remember | Type + fetch a code | Glance or tap |
The table makes the point that gets lost in "passwordless" marketing: a passkey runs on a different security model from a password, not just a smoother version of one. There’s no reusable secret at any point in the chain.
Two flavors exist, and the difference matters for both security and recovery. Synced passkeys replicate across a user’s devices through a platform provider’s encrypted keychain: convenient, and they survive losing one device because they live in the cloud-backed sync. Device-bound passkeys (typically on hardware security keys) never leave the single authenticator, which is higher assurance but means losing the device means losing that credential. Consumer deployments lean toward synced passkeys for recoverability; the highest-assurance use cases may require device-bound keys. Knowing which you’re relying on shapes how you design recovery.
The credential is the easy part; the lifecycle is where deployments succeed or fail. Enrollment needs a smooth path (often offered at login or after a step-up). Recovery and device-change need to be secure without falling back to a phishable method like SMS. And you’ll run passkeys alongside other methods during the transition, which means a risk engine deciding when a fallback is safe. Pairing passkeys with device intelligence lets you spot social-engineering attempts around recovery, the exact place attackers pivot to once the login itself is unphishable.
Are passkeys more secure than passwords?
Yes, they’re phishing-resistant and involve no shared secret to steal, unlike passwords.
What standards are passkeys based on?
FIDO2 and WebAuthn, using public-key cryptography.
What happens if I lose the device with my passkey?
Passkeys often sync across a user’s devices; otherwise a secure recovery flow is needed, which is why recovery design is critical.
Are passkeys a complete security solution?
They’re a major improvement but need secure recovery and lifecycle handling, ideally backed by a risk engine.
What’s the difference between synced and device-bound passkeys?
Synced passkeys replicate across a user’s devices for recoverability; device-bound passkeys stay on one authenticator for higher assurance.
Can passkeys be phished?
Not in the usual sense, a passkey is bound to the legitimate site’s origin, so it won’t work on a lookalike phishing page.
Related: FIDO2 · WebAuthn · Passwordless Authentication · Biometric Authentication · FIDO Alliance · Account Recovery
