What Are Passkeys?

Passkeys are a modern authentication technology that replaces passwords with cryptographic credentials stored on your devices. Built on FIDO/WebAuthn standards, passkeys provide phishing-resistant authentication that's both more secure and easier to use than traditional passwords, supported across major platform ecosystems, including Apple, Google, and Microsoft.

Passkeys explained

A passkey is a cryptographic credential that proves your identity without transmitting a secret. When you create a passkey for a website or app, your device generates a unique key pair. The private key stays on your device, protected by your screen lock (fingerprint, face recognition, or PIN). The public key goes to the service. To sign in, your device proves it has the private key, the service never sees the key itself, just mathematical proof that you possess it.

From the user's perspective, signing in with a passkey is simpler than using a password. You select your account and authenticate with your device's screen lock, the same fingerprint or face scan you use to unlock your phone. There's nothing to remember, nothing to type, and nothing that can be phished.

Security advantages

Passkeys eliminate the vulnerabilities that make passwords problematic. There's no shared secret to steal, the service stores only your public key, which is useless without the private key locked in your device. There's nothing to phish, passkeys are cryptographically bound to specific websites, so they won't work on lookalike domains. There's no credential reuse, each passkey is unique to a single service.

Passkeys are FIDO/WebAuthn credentials that can be phishing-resistant. Depending on how they’re implemented (e.g., hardware-backed key protection, user verification, and deployment policy), passkeys can satisfy higher NIST authentication assurance requirements. They combine something you have (your device) with something you are (biometric) or something you know (PIN), all in a single seamless authentication gesture.

Synchronization and recovery

Unlike hardware security keys, passkeys can synchronize across your devices through your platform's cloud account. A passkey created on your iPhone is automatically available on your iPad and Mac through iCloud Keychain. Google synchronizes passkeys across Android devices and Chrome through your Google account. Microsoft is implementing similar synchronization for Windows devices.

This synchronization addresses a major usability challenge with device-bound credentials: what happens when you get a new device or lose your current one? With synchronized passkeys, you can simply sign in to your new device using your platform account, and your passkeys will be available. You don't need to re-register with every service.

Passkeys and digital identity

Passkeys play an essential role in digital identity ecosystems, particularly for securing access to digital wallets and credentials. When you enroll in a state digital identity program or set up a wallet to hold your mobile driver's license, passkeys can provide strong authentication to the state's account system or wallet provider.

This matters because the security of verifiable digital credentials depends not just on the credentials themselves but on protecting access to them. A mobile driver's license with sophisticated cryptographic protections is only as secure as the authentication that controls who can present it. Passkeys ensure that only you can unlock your wallet and use your credentials.

FIDO Alliance certifications provide assurance that passkey implementations meet security requirements. As digital identity ecosystems mature, wallet certification programs are beginning to recognize FIDO-certified authentication as meeting requirements for secure key management and phishing-resistant access control.

Adoption and considerations

Passkeys are now supported across major platforms. Apple, Google, and Microsoft have all implemented passkey support in their operating systems and browsers. Many major services, including Google, Apple, Microsoft, PayPal, and eBay, accept passkeys for authentication.

Some considerations remain as the technology continues to mature. Recovery and portability depend on platform ecosystems, moving from iPhone to Android, for example, requires re-registering passkeys. Organizations deploying passkeys need robust recovery planning for scenarios where users lose access to their devices and platform accounts simultaneously. And while passkey support is growing, not all services have implemented it yet.

Despite these considerations, passkeys represent a significant advancement in authentication. They deliver stronger security than passwords while being easier to use, a combination that historically has been difficult to achieve. For digital identity systems that require high-assurance authentication, passkeys provide a proven, widely supported foundation.