Passkeys are intended to replace the password as the most important sign-in factor. They are based on the open standards FIDO2 and WebAuthn, developed by the FIDO Alliance and the W3C, and are supported by common operating systems and browsers. For users, signing in feels like unlocking their smartphone.
Passkeys are interesting for companies because they solve two problems at once: there is no longer a password that can be forgotten, reused, or stolen, and the sign-in is resistant to phishing.
How does a passkey work?
During registration, the device generates a key pair. The public key is stored with the service, while the private key remains protected on the device, in the security key, or in the password manager. At sign-in, the service sends a random challenge that is signed with the private key. Before that, the person verifies locally, for example with a fingerprint, facial recognition, or device PIN.
Each passkey is bound to the service's domain. A fake sign-in page at a different address therefore does not receive a valid signature. Since the service stores only public keys, a data leak there cannot be used to gain access either.
There are two forms:
- Synced passkeys are transferred to several devices via a user account or a password manager.
- Device-bound passkeys remain on a specific device or hardware security key and cannot be copied.
Typical examples
- Signing in to Microsoft 365 or other cloud services with a passkey in an authenticator app or on a security key.
- Administrator accounts that can be used only with a hardware security key.
- Customer portals that offer passkeys as a convenient alternative to passwords.
What companies should keep in mind
- Check the identity platform in use for passkey support and define which types of passkeys are allowed.
- Prefer device-bound passkeys for privileged accounts.
- Plan recovery in case a device is lost, without creating an insecure backdoor.
- Start the rollout step by step and support employees with short guides.
How it differs
A passkey with local verification combines two factors: possession of the device and biometrics or a PIN. It is therefore generally recognized as multi-factor authentication. Unlike one-time codes by SMS or app, it is also bound to the genuine website.
View security services