How Passkeys Work
FIDO's user authentication standards leverage public key cryptography techniques to provide user-friendly, phishing-resistant authentication that allows users to sign in with passkeys.
The following video shows passkeys in action.
Enrolling a passkey with the online service
To begin, the user registers a passkey with the online service. Each service gets its own unique set of credentials, protecting the user from cross-site tracking. The initiation of registration typically happens either at the sign-in settings page (which the user self-discovers) or through a promotion of the setting to the user (for example, a call to action made to the user by the online service during sign-in).
The passkey registration process typically occurs after the user signs in to the online service account with an existing authentication method. The user approves passkey creation using their device’s built-in security features (such as fingerprint, face, or PIN) or an external hardware security key.
The user’s device or security key creates and securely retains the private key associated with the passkey, while the public key is registered with the online service. Depending on the platform and authenticator type, passkeys may be synchronized across a user’s trusted devices through a credential manager ecosystem, or they may remain bound to a specific hardware, like a security key.
Most modern operating systems include built-in support for passkeys and credential management. Users may also choose to use a third-party credential manager that supports passkeys.
If the user chooses to use a hardware security key, the passkey remains on that physical authenticator rather than being synchronized across devices.
Sign in to the online service with a passkey
When the user attempts to sign in to the online service, they see a prompt asking them to choose which account they want to use, and then a prompt to unlock their device (or their security key) using a biometric or local PIN. After the user is verified, they are signed-in to their online account. The browser, operating system, password manager and/or security key work together to make this a seamless experience.
Technical overview
At the registration step, the password manager (or security key) creates a cryptographic keypair that is unique to that particular account on that particular online service. The password manager (or security key) securely retains the private key and the public key is registered with the online service.
When the user attempts to sign in to the online service, the server sends a random challenge to the user’s device. After the user approves the sign-in by unlocking their device or interacting with their security key, the password manager (or security key) signs this challenge using the appropriate private key. The signature is returned to the server which verifies the signature against the public key it has on record. For more information on how passkeys provide extra security and phishing resistance, refer to the Phishing resistance section.
When the user installs the password manager on a different device, their private keys sync automatically, allowing them to sign in to their online services.
If the user is using a security key to store their passkey, the private key does not sync and remains bound to that physical security key. To use a security key with a new device, the user can tap or plug in the security key to the new device. Security keys provide additional attestation signals that a service can use to validate the manufacturer and the certification level that is maintained by the FIDO metadata service.
Passkeys are secure by design
By design, a passkey is only presented to the site it was registered with. There is no way for the user to inadvertently type it on an attacker’s site. In addition, the online service does not have the equivalent of a password hash, which can be stolen from the server and cracked by an attacker to figure out the password. The online service only has the public key and it is not computationally feasible to extract the private key from the public key per the mathematics of cryptography.
Passkeys are private by design
A unique passkey is created for each domain and account. So there is no way for multiple online services to collaborate to track the user. The device unlock (using biometric or PIN), or interaction with a security key, stays local. The online service only receives the public keys and signatures needed to verify the sign-in. For a person to use the private key, the password manager uses an API provided by the operating system to directly leverage the familiar, and private-by-design, device unlock that device operating systems have already been shipping for many years now.
Enroll a passkey with an online service
The following steps outline the process for a user to enroll a passkey with their online service account:
- The user accesses the app or website.
- The user receives a prompt from the online service to create a passkey or initiates passkey creation from their Account Settings.
- Using their device, the user verifies the passkey creation via a local authentication method such as biometrics, local PIN, or by touching their FIDO security key.
- The user’s device creates a new public/private key pair (passkey) unique to the local device, online service, and user’s account.
- A public key is sent to the online service and associated with the user’s account. Any information about the local authentication method (such as biometric measurements or templates) never leaves the local device.
Using a passkey for subsequent sign in
- The user receives a prompt on the client device to sign in with a passkey.
- Users with multiple accounts are asked to choose which account to use.
- The user receives a prompt to complete a local authentication method using biometrics, local PIN, or by touching their FIDO Security Key.
- The client device sends the signed challenge back to the service, which verifies it with the stored public key and signs the user in.
