Passkey (credential)

Passkey, also known as security key, is a pair of cryptographic keys that is generated by a user's authenticator bounded to an account to authenticate a user's identity against a remote application or system by using public-key cryptography, thus avoiding the need to reveal the secret key hold by the user through public channels. The current popular implementation of passkeys for general public usage in web technologies is proposed by FIDO Alliance and standardised by the World Wide Web Consortium under the WebAuthn standard, and passkeys is generally referred as a de-facto non-technical term of WebAuthn credential.

Technical

Passkey is based on public-key cryptography that is designed for passwordless authentication, where user credential is a private key stored on the user's authenticator and the application system stores the public key that can be used to create a cryptographic challenge that can only be solved by the user credential, thereby authenticating the user's identity. The process transfers only publicly-known information to the user, who then returns the solved challenge without transferring the private key openly through public channels (which may be eavesdropped), thus making it more secure than traditional authentication method such as passwords that could be tapped and used by remote attackers. The term passkey does not refer to any specific technology, but due to the origin and widespread adoption within FIDO2 ecosystem, the term is now commonly associated with FIDO2 credential.

The user credential (private key) is stored inside an authenticator, which may be a physical device (common referred as a security key), secure cryptoprocessor such as Trusted Platform Module, password managers or keyrings. Software-based authenticator clients may offer additional features such as biometric authentication like Touch ID or Windows Hello for better security, or cloud sync for ease of usage across devices.

Implementations

FIDO2 (WebAuthn + CTAP2)

FIDO2 passkeys are commonly used by web technologies such as mobile apps and websites for user authentication. This is done by allowing applications to request a challenge from the device client (e.g. web browser or operating system) through WebAuthn, and then the device client relaying to the hardware carrying out the cryptographic operation through CTAP2.

The use of the term passkey to refer to the private key/user credential starts in June 2022, where Apple announces that they will start to support passkeys as an authentication method in iOS and macOS devices, debuting the term "passkey" to the general public. Google announces that Android and Google Chrome will support passkeys too on October 2022, followed by Microsoft on Windows 11 at September 2023.

Some implementations of WebAuthn passkeys allow storage of user identifiers inside the passkey itself, allowing users to directly authenticate as the defined identity instead of providing an identifier (such as email or username) separately. Other implementations of WebAuthn passkeys acts as part of multi-factor authentication, requiring additional authentication methods like password or email verification to be used together.

Resident Key

A resident key is a private credential that is specifically stored inside an external physical device that may be disconnected from the machine that validates the credential. This is used by OpenSSH protocol. In WebAuthn, it is called a discoverable credential.

FIDO UAF

FIDO Universal Authentication Framework (UAF), along with FIDO U2F, are precursor designs of FIDO2, and influenced the design of FIDO2. FIDO UAF stores the private key directly on physical devices (commonly smartphones) instead of relying on external authenticator protocol such as CTAP. As the private key is bounded to the physical device, it could not be backed up or transferred to another device.

Benefits

Passkeys are more convenient than traditional authentication methods and offer greater resistance to phishing attacks. They are protected by the devices on which they are stored and often leverage biometric authentication as an additional layer of security, eliminating the need for users to remember passwords. Compared with related terms such as FIDO and WebAuthn, the term “passkey” is generally preferred in marketing because it is less likely to cause confusion and avoid pushing out jargon. However, as of 2026, most platforms still offer other methods of authentication alongside passkeys, which may reduce the benefits of using passkeys.

In the media

Passkeys (implemented through WebAuthn) has received mixed responses from the public:

Troy Hunt: "Passkeys are one of the few security constructs that make your life easier, rather than harder." "That's a one-click sign-in, and clicking the purple button immediately grants me access to my account."
Dan Goodin: "Passkey technology is elegant, but it’s most definitely not usable security."
Bruce Davie: "...the implementation seems to have failed the 'make it easy for users' test, which in my view is the whole point of passkeys. I have been using public key cryptography for 30-plus years... If I find passkeys confusing to use, it doesn’t bode well for more typical users."