{"id":468,"date":"2026-09-11T13:09:00","date_gmt":"2026-09-11T10:09:00","guid":{"rendered":"https:\/\/soakjam.com\/knowledge\/?p=468"},"modified":"2026-09-10T14:45:40","modified_gmt":"2026-09-10T11:45:40","slug":"what-is-a-passkey","status":"publish","type":"post","link":"https:\/\/soakjam.com\/knowledge\/what-is-a-passkey\/","title":{"rendered":"What Is a Passkey and How Does It Work?"},"content":{"rendered":"\n

A passkey lets you sign in to a website or app with the same fingerprint, face scan, PIN or pattern used to unlock a trusted device. There is no password to remember, type or reuse. Behind that familiar action is public-key cryptography designed to resist the fake login pages that steal ordinary passwords.<\/p>\n\n\n\n

Passkeys are appearing across phones, computers, password managers and major online services. The change can feel confusing because \u201cpasswordless\u201d does not mean \u201csecurity-free,\u201d and the face or fingerprint is not normally sent to the website. The device proves that it holds a cryptographic credential created for that specific service.<\/p>\n\n\n\n

\n

Quick answer:<\/strong> A passkey is a digital sign-in credential made from a cryptographic key pair. The website stores a public key. Your phone, computer or credential provider protects the matching private key. When you approve a login with your device unlock, the private key signs a challenge. The site verifies the signature without receiving a reusable secret.<\/p>\n<\/blockquote>\n\n\n\n

What Is a Passkey? Key Facts at a Glance<\/h2>\n\n\n\n
Question<\/th>Passkey answer<\/th><\/tr><\/thead>
What does the website store?<\/td>A public key and account information<\/td><\/tr>
What stays protected?<\/td>The matching private key<\/td><\/tr>
How do you approve sign-in?<\/td>Device PIN, pattern, fingerprint, face recognition or security key action<\/td><\/tr>
Can it be typed into a fake site?<\/td>No; the credential is bound to the legitimate site or app<\/td><\/tr>
Can it work on another device?<\/td>Yes, through secure synchronization, a hardware key or cross-device sign-in<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The FIDO Alliance<\/a> defines passkeys as password replacements based on FIDO standards. On the web, the underlying authentication is provided through Web Authentication, or WebAuthn<\/a>.<\/p>\n\n\n\n

How a passkey is created<\/h2>\n\n\n\n

When a service offers \u201cCreate a passkey,\u201d the website asks the operating system or credential manager to register a new credential. The device creates two mathematically related keys. The public key is sent to the service. The private key remains inside the device\u2019s secure hardware or the protected credential provider.<\/p>\n\n\n\n

The pair is unique to that account and service. Creating a passkey for one shopping site does not give the site a key that works at a bank, email service or social network. This separation removes password reuse, one of the main ways a breach at one service can lead to account takeover elsewhere.<\/p>\n\n\n\n

The service also records an identifier that helps find the correct credential later. It does not receive a copy of your fingerprint or face template from the passkey process. Biometric matching is normally performed locally by the operating system to unlock use of the private key.<\/p>\n\n\n\n

\"Private
The private key stays protected; the site verifies signatures with the public key.<\/figcaption><\/figure>\n\n\n\n

What happens during sign-in?<\/h2>\n\n\n\n
    \n
  1. The website sends a fresh, random challenge to the device.<\/li>\n\n\n\n
  2. The device confirms that the request belongs to the correct website or app.<\/li>\n\n\n\n
  3. You approve with the device-unlock method.<\/li>\n\n\n\n
  4. The private key signs the challenge without leaving its protected storage.<\/li>\n\n\n\n
  5. The website uses the stored public key to verify the signature.<\/li>\n<\/ol>\n\n\n\n

    Because the challenge changes, a captured response cannot simply be replayed. Because the private key is never sent, the server database does not contain the reusable secret needed to impersonate the user. The service can still suffer other breaches, but a stolen public key cannot be used like a stolen password.<\/p>\n\n\n\n

    Why passkeys resist phishing<\/h2>\n\n\n\n

    A password can be entered into any form that looks convincing. A passkey is associated with the digital identity of the real website, called the relying party. A fake domain cannot ask the device to use a passkey registered for the genuine domain. The browser and operating system enforce that relationship.<\/p>\n\n\n\n

    This origin binding is the central advantage. An attacker might copy a logo, page design and urgent message, but the copied page does not gain the legitimate site\u2019s domain identity. The passkey will not produce the expected signature for it.<\/p>\n\n\n\n

    CISA recommends phishing-resistant authentication<\/a> where possible. NIST\u2019s current digital identity guidance<\/a> explains requirements for cryptographic authenticators and verifier-name binding.<\/p>\n\n\n\n

    Are passkeys the same as biometrics?<\/h2>\n\n\n\n

    No. A passkey is the cryptographic credential. A fingerprint or face scan is one possible way to unlock that credential locally. A device PIN or pattern can often do the same job. If biometrics are disabled or unavailable, the passkey may still work through another approved device-unlock method.<\/p>\n\n\n\n

    This distinction explains why a website does not need to receive biometric data. The website asks for proof from the credential. The operating system decides whether the local user has met the unlock requirement. Exact storage and privacy design vary by platform, so consult the device provider for details.<\/p>\n\n\n\n

    Synced and device-bound passkeys<\/h2>\n\n\n\n

    A synced passkey is protected and copied across devices through a credential manager, such as a platform account or compatible password manager. This makes recovery and device replacement easier. A device-bound passkey stays on one authenticator, often a hardware security key or a managed device.<\/p>\n\n\n\n

    Type<\/th>Main benefit<\/th>Main consideration<\/th><\/tr><\/thead>
    Synced passkey<\/td>Convenient across phones, tablets and computers<\/td>Security and recovery depend partly on the provider account<\/td><\/tr>
    Device-bound passkey<\/td>Credential does not leave that authenticator<\/td>Loss can require a backup authenticator or account recovery<\/td><\/tr>
    Cross-device sign-in<\/td>Use a nearby phone to approve login on another screen<\/td>Both devices need a supported secure flow and proximity<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Synchronization does not mean that websites receive the private key. The credential provider encrypts and protects it according to its architecture. Apple describes passkeys in iCloud Keychain as end-to-end encrypted<\/a>; other providers publish their own design and recovery rules.<\/p>\n\n\n\n

    How cross-device sign-in works<\/h2>\n\n\n\n

    If the passkey is on your phone but the login page is on a different computer, the site may display a QR code. Scanning it starts a protected exchange and verifies that the devices are close, commonly using Bluetooth as part of the proximity check. You then approve on the phone.<\/p>\n\n\n\n

    The QR code is not the passkey itself. It helps establish the temporary connection. Do not scan an unexpected sign-in code sent by someone else; an attacker may be trying to make you approve their session. Start from the service you intend to use and read every confirmation screen.<\/p>\n\n\n\n

    \"Phone
    Cross-device sign-in lets a nearby trusted phone approve access on another screen.<\/figcaption><\/figure>\n\n\n\n

    What if you lose your phone?<\/h2>\n\n\n\n

    Recovery depends on how the passkey was stored. If it was synchronized, signing in to the credential provider on a replacement device may restore it after the provider\u2019s recovery checks. If it was device-bound, use a backup security key, another registered device or the service\u2019s recovery process.<\/p>\n\n\n\n

    Before relying on passkeys for an important account:<\/p>\n\n\n\n