Cybersecurity glossary
What is a Passkey?
Learn what a passkey is, how synced and device-bound FIDO credentials enable phishing-resistant login, recovery considerations, and best practices for deploying passkeys.
Definition
A passkey is a FIDO/WebAuthn discoverable credential—often synced across a user’s devices by a platform provider—that authenticates with public-key cryptography instead of a reusable password, typically unlocked by biometrics or a device PIN.
Why passkeys feel like the password replacement people wanted
Users want unlock-with-face simplicity. Attackers want secrets they can phish. Passkeys deliver convenience with origin-bound cryptography: the private key stays in an authenticator ecosystem, and only the real site can complete a valid login ceremony.
They are rapidly becoming the default face of FIDO2 for consumers and workforce IAM.
What happens during passkey login
Relying party requests authentication
The site calls WebAuthn with a challenge for registered credentials.
Authenticator finds a passkey
Platform or roaming authenticator locates a discoverable credential for that RP ID.
User verifies locally
Biometrics or PIN unlock the private key without sending biometrics to the website.
Origin-bound assertion
The authenticator signs the challenge for the legitimate origin only.
Server verifies and opens a session
Public key validation succeeds; the application establishes a logged-in session.
Passkey flavors
Synced platform passkeys
Roam across phones and laptops via a vendor sync fabric for easier recovery.
Device-bound passkeys
Stay on one authenticator—higher control for some enterprise policies.
Security key passkeys
Discoverable credentials on hardware keys for shared or high-assurance use.
Cross-device flows
QR/Bluetooth hybrid ceremonies let a phone passkey sign in on another device.
Password manager passkeys
Third-party managers can store and sync passkeys across browsers.
Workforce + customer
Same WebAuthn core, different recovery and attestation policies.
Passkeys vs older MFA
| Method | User types a secret? | Phishing resistance |
|---|---|---|
| Password + SMS OTP | Yes | Low |
| Password + TOTP | Yes | Low–medium |
| Push approve | No (but tapable) | Medium (fatigue) |
| Passkey | No | High (origin-bound) |
Deployment checklist
- Offer passkeys as a primary sign-in method, not only buried MFA settings.
- Support backup authenticators: second device, security key, or controlled recovery.
- Harden account recovery so it cannot trivially bypass passkeys.
- Validate WebAuthn RP ID, origin, challenge freshness, and signatures strictly.
- Decide attestation requirements for privileged workforce populations.
- Monitor new passkey registrations as sensitive account events.
- Educate users that real sites never ask them to ‘type their passkey’.
- Plan gradual password retirement once passkey adoption and recovery are solid.
The practical takeaway
A passkey is a phishing-resistant, user-friendly FIDO credential that can replace passwords for everyday sign-in. Synced passkeys improve recovery; device-bound and hardware options serve stricter policies.
Deploy the ceremony carefully, then spend equal effort on enrollment and recovery—the places attackers go when they cannot phish the authenticator itself.
Related security terms
FIDO2
Standards suite that enables passkey authentication.
Web Authentication API (WebAuthn)
Browser API used to create and assert passkeys.
Passwordless Authentication
Broader login model passkeys commonly implement.
Phishing-Resistant MFA
Security property passkeys are designed to provide.
Hardware Security Key
Roaming alternative or backup to platform passkeys.
Frequently asked questions
What is a passkey in simple terms?
A passkey is a saved login credential on your phone or computer that unlocks with Face ID, fingerprint, or a PIN. Websites get a cryptographic proof—not a password you can type into a fake site.
Are passkeys the same as passwords stored in a manager?
No. Password managers store shared secrets. Passkeys use asymmetric keys bound to the website’s identity, which phishing pages cannot reuse.
What is a synced vs device-bound passkey?
Synced passkeys can travel across devices via a platform account (for example Apple, Google, or a password manager). Device-bound passkeys stay on one authenticator, such as a single laptop or security key.
Do passkeys replace MFA?
A passkey ceremony already combines possession of the credential with local user verification, providing MFA-like assurance in one step for many threat models.
What if I lose my device?
Use synced passkeys, backup security keys, or a controlled account recovery process. Weak recovery can undo passkey benefits.
Can enterprises require hardware-only passkeys?
Yes. Some policies prefer device-bound or attested security keys for administrators while allowing synced passkeys for standard users.
Are passkeys phishing-resistant?
Yes for the authentication ceremony itself because assertions are origin-bound. Protect enrollment and recovery with equal care.
References
Explore authoritative guidance and frameworks related to passkey.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.