Passkeys: Easier, More Secure Passwordless Login
Passkeys let you sign in without a password. This article explains how they work and the role your device plays.
The FIDO Alliance develops open authentication standards. Passkeys use these standards to enable passwordless sign-in to websites and apps.
What are passkeys?
Passwords and one-time codes can be intercepted through phishing. Passkeys are bound to the relevant service and avoid entering these credentials.
A passkey is a digital credential based on a cryptographic key pair. It can be stored on a device or security key, or synchronised through a passkey provider.
The service stores the public key. During sign-in, the authenticator signs a challenge with the private key. The service verifies the signature using the public key; it does not receive the private key.
Websites integrate passkeys through the WebAuthn API. The browser and operating system connect the service to the authenticator. The Client to Authenticator Protocol (CTAP) handles communication with external authenticators.
Because passkeys are stored on the relevant devices, an important question arises: how can those devices be protected against unauthorized access? If an attacker gets hold of someone else's device, this must not automatically provide access to the services configured on it.
Modern devices — whether laptops, smartphones or smart TVs — therefore support unlocking with biometric characteristics. Familiar methods include fingerprint scanning and Face ID. Combining a passkey with biometric confirmation enables particularly secure authentication.
Passkeys remove the need to remember and enter passwords and are designed to resist phishing. Their use depends on support from the service, browser and device.
Before switching, check how you can regain access to your account after replacing or losing a device.
We can advise on using two-factor authentication and passkeys in your business.