Cybersecurity

What is Passkey?

Quick answer

A passwordless sign-in credential based on FIDO2 and WebAuthn that uses a cryptographic key pair stored on your device instead of a password.

Passkey, explained

When you create a passkey for a website or app, your device generates a unique pair of cryptographic keys. The private key stays on your device or in a credential manager, while the public key is stored by the service. To sign in, you confirm with your fingerprint, face scan, or device PIN, and the device proves it holds the private key without ever sending it.

Passkeys resist phishing because they are tied to the genuine website's domain, so a lookalike site cannot use them. They also cannot be reused across sites, and a breach of a service's database exposes only public keys. Major platforms from Apple, Google, and Microsoft support passkeys, which can sync across a person's devices. Account recovery and moving passkeys between ecosystems are still areas of ongoing improvement.

Related terms

Guides that mention Passkey