Passkeys explained: how signing in without a password works
A passkey replaces the secret you type with a key your device keeps. Here is what happens when you tap to sign in.
Kivorent News desk, , 2 min read
What to know
- A passkey is a pair of cryptographic keys. The website holds the public half and your device keeps the private half.
- Your fingerprint or face unlocks the key on your device. It is never sent to the website.
- A passkey only works on the site it was made for, which is what defeats phishing pages.
Passwords fail in predictable ways. People reuse them, sites leak them, and fake login pages collect them. Passkeys were designed to remove the thing that gets stolen.
Two keys in place of one secret
When you create a passkey for a website, your phone or computer generates two mathematically linked keys.
- The public key goes to the website. It can check a signature but cannot create one, so it is harmless if stolen.
- The private key stays on your device, protected by the same lock you use for the device itself.
A password is a secret that both you and the website know. With a passkey, the website never holds anything worth stealing.
What happens when you sign in
- The website sends your device a random challenge.
- Your device asks you to prove you are there, with a fingerprint, a face scan or the device PIN.
- Your device signs the challenge with the private key and sends the signature back.
- The website checks the signature against your public key and lets you in.
Your fingerprint or face data does not leave the device. It only unlocks the key.
Why phishing stops working
Each passkey is tied to the web address it was created for. If a message sends you to a lookalike site, your device finds no passkey for that address and has nothing to offer. A person can be fooled by a convincing page. The device compares addresses exactly.
What about a lost phone?
Most people keep passkeys in a password manager that syncs them: the one built into Apple, Google or Microsoft accounts, or a separate one. Sign in to that account on a new device and your passkeys come back. That makes the account holding your passkeys the one to protect most carefully, with a strong password and a recovery method you have tested.
Hardware security keys work differently. The passkey lives on the physical key and does not sync, so you need a spare.
Common questions
Is a passkey the same as two-factor authentication? It covers both factors in one step: something you have, the device, and something you are or know, the biometric or PIN.
Can I still use my password? Many sites keep the password as a fallback. The account is only as strong as its weakest way in, so remove the password where a site allows it.
Can I sign in on someone else's computer? Yes. The site shows a QR code, you scan it with your phone, and the phone does the signing over a short-range connection.
Spotted an error? Tell us and we will fix it.