What is a passkey and how does it work? The complete guide to passwordless security

A passkey is a phishing-resistant, passwordless authentication credential based on public-key cryptography. When you create a passkey, your device generates a unique cryptographic key pair: a public key stored on the website's server and a private key that never leaves your device. You log in by verifying your identity with biometrics or a PIN.

This approach, standardized by the FIDO Alliance and central to passwordless authentication. It prevents phishing and credential theft because the private key never leaves your device. The model aligns with NIST SP 800-63B-4 guidelines and GDPR privacy requirements.

In practice, most organizations run mixed environments — some services already support passkeys, others won't for years. A structured approach to credential management covers both.

This guide covers everything: how passkeys work technically, the difference between synced and device-bound passkeys, how to set them up on iPhone, Android, and Windows, and what the latest 2025–2026 data says about real-world performance.

Key takeaways

• Passkeys use public-key cryptography: the private key stays on your device; the server only stores the public key.
• Passkeys are phishing-resistant by design — a fake website cannot request your passkey signature.
• Passkey sign-ins achieve a 93% success rate, compared to 63% for other authentication methods (FIDO Alliance Passkey Index, October 2025).
• If you lose your device, synced passkeys are recoverable via iCloud Keychain or Google account recovery.
• As of end 2024, 15+ billion accounts support passkeys, and adoption doubled over the course of that year (FIDO Alliance, December 2024).

What is a passkey?

A passkey is a cryptographic key pair stored on your device. The FIDO Alliance — the industry consortium behind the standard — defines passkeys as credentials that "replace passwords with cryptographic key pairs for phishing-resistant sign-in security and an improved user experience."

Passkeys implement the FIDO2 standard, with WebAuthn handling browser-device communication. When you create a passkey, your device generates two mathematically linked keys: one stays on your device (private), one goes to the website (public).

To log in, you prove you hold the private key by solving a cryptographic challenge — using your face, fingerprint, or PIN. The website verifies your answer using the public key it already has.

The private key never leaves your device. The server never sees it. There's nothing on the server side worth stealing.

Passkeys in simple terms

A passkey is something you have (your device) plus something you are (your fingerprint or face). Your phone generates the passkey, and you unlock it with biometrics. 

The service never sees your fingerprint or face, only that you unlocked the key. Think of it like a hotel key card: you have the card, and the door unlocks when you tap it. No code to remember, nothing to type, nothing to steal remotely.

The problem with traditional passwords

Passwords have a fundamental flaw: they're secrets that must be shared. Every time you type one, it travels across networks and sits on servers. The 2025 Verizon DBIR found over 53% of data breaches involve stolen or brute-forced credentials.

Users compound the problem. Password reuse is rampant, a breach at one service cascades into compromised accounts everywhere. Phishing exploits this further: fake login pages trick users into typing credentials, handing attackers direct access. Add password fatigue, and you get sticky notes or "Company2024" variants.

Common password problems:

• Reuse — one breach unlocks multiple accounts.
• Weak passwords — "123456" still dominates.
• Phishing vulnerability — fake sites capture typed credentials.
• Server-side exposure — leaked databases get cracked.
• Memory burden — users reset, write down, or simplify.

With passkeys, there's no password to remember, no password to steal, and no server database to breach.

How passkeys actually work

Passkeys use public-key cryptography instead of shared secrets. Think of it like a physical mailbox: the public key is the slot anyone can drop a message through, and the private key is the key that opens the box. Only the person with the private key can read what's inside.

When you log in with a passkey, the service or website sends a challenge — a unique, random string of data. Your device uses the private key to sign that challenge mathematically. The website then checks the signature against the public key it stored during registration. If the signature is valid, you're in.

The FIDO Alliance standardizes this through FIDO2. WebAuthn handles browser-device communication. NIST recognizes this model as phishing-resistant.

Step by step:

1. Device creates key pair
2. Private key stays on device
3. Public key sent to service
4. Service sends challenge
5. You approve with biometrics
6. Device signs challenge
7. Service validates signature
8. You're logged in

Step 1. The registration process

The process of creating a passkey is called the registration ceremony in the WebAuthn specification — the W3C web API that implements FIDO2 in browsers.

Here's what happens:

1. You visit a website and choose to create a passkey.
2. The website sends a registration request to your browser via the WebAuthn API.
3. Your browser prompts you to verify your identity — Face ID, fingerprint, or PIN.
4. Your device generates a unique public/private key pair specifically for this website.
5. The public key is sent to the website's server and stored. The private key is saved in your device's secure hardware — the Secure Enclave on Apple devices, or the TPM (Trusted Platform Module) chip on Windows.

Apple, Google, and Microsoft each implement this through platform-specific APIs (iCloud Keychain, Google Password Manager, Windows Hello), but all follow FIDO2 and WebAuthn standards. Your biometric data never leaves your device, only the cryptographic proof that you authorized key creation.

Step 2. The authentication process

Signing in with a passkey — the authentication ceremony — is equally straightforward:

1. You visit the website and click "Sign in with passkey."
2. The website sends a unique, random challenge to your browser.
3. Your browser prompts you to verify your identity (biometrics or PIN).
4. Your device uses the private key to cryptographically sign the challenge.
5. The signed challenge goes back to the server. The server verifies the signature using the stored public key. If it matches, access is granted.

WebAuthn standardizes this flow across browsers and platforms. The private key never leaves your device, and the challenge-response mechanism prevents replay attacks.

The challenge is unique every time. Even if an attacker intercepts the signed response, they can't reuse it — it's mathematically bound to that single session.

Cross-device authentication: QR codes and Bluetooth

Here's a scenario that confuses many users: you're on a Windows laptop, but your passkey is stored on your iPhone. What happens?

The browser displays a QR code. You scan it with your phone. The phone and laptop then establish a short-range Bluetooth connection to verify physical proximity — this is the hybrid transport mechanism defined in the FIDO2 CTAP2 protocol.

The Bluetooth proximity check is the critical security step. It prevents a remote attacker from using the QR code from a different location. Your phone performs the biometric verification locally, then sends the signed challenge back to the laptop through the secure Bluetooth channel.

Bluetooth isn't transmitting your passkey. It's confirming that your phone is physically next to the computer — which is what makes cross-device authentication phishing-resistant even when using a second device.

Passkeys vs. passwords: Key differences

A password is a secret string of characters you create and submit to a server to verify your identity. Passwords have a fundamental structural flaw: they're shared secrets. The website stores your password (or a hash of it), which means a server breach exposes it. Passkeys are cryptographic proofs, your device holds the private key; services hold only useless public keys.

Cloudflare's March 2025 data found that approximately 41% of successful human authentication attempts involve leaked credentials. That number reflects years of password reuse across breached databases.

Types of passkeys: Synced vs. device-bound

Not all passkeys are the same. The distinction between synced and device-bound passkeys matters for both security and compliance — and most guides skip it entirely.

Synced passkeys (multi-device FIDO credentials)

Synced passkeys are stored in a cloud-based credential manager and automatically synchronize across all devices in your ecosystem. Create a passkey on your iPhone, and it's immediately available on your iPad and Mac.

These passkeys are end-to-end encrypted. The cloud provider cannot read them. As of NIST SP 800-63B-4 (published 2025), synced passkeys qualify as AAL2 (Authentication Assurance Level 2) authenticators — appropriate for most consumer and enterprise use cases.

Best for: General consumers, most enterprise applications, services where cross-device convenience matters.

Device-bound passkeys

Device-bound passkeys are stored on a specific piece of hardware — a hardware security key such as a YubiKey, or the TPM chip in a Windows device — and cannot be copied or synchronized. They exist only on that one device.

Under NIST SP 800-63B-4, device-bound passkeys qualify as AAL3 — the highest authentication assurance level, required for government systems, financial institutions, and high-security enterprise environments.

Best for: Privileged access management, regulated industries, government systems.

Are passkeys secure?

Yes. Passkeys are significantly more secure than passwords. Passkeys eliminate entire categories of attacks by design. They're phishing-resistant by design and immune to credential stuffing. The private key never leaves the user's device.

This architecture, built on public-key cryptography, also neutralizes server breaches. Services store only public keys, useless to attackers. Even if a database leaks, credentials remain safe.

The 2025 Verizon DBIR shows credential theft driving 88% of web application breaches. Passkeys make that vector irrelevant. NIST SP 800-63B classifies this model as phishing-resistant, the highest authentication assurance level.

Security benefits:

• Phishing impossible — cryptographically bound to specific sites
• No credential theft — private keys never leave devices
• Server breaches neutralized — public keys only, useless to attackers
• No replay attacks — challenge-response prevents reuse
• Biometric binding — local verification, biometrics never transmitted

Secure by design

Passkeys build security into the architecture, not user behavior. With public-key cryptography, the private key never leaves your device. It stays in secure hardware (TPM, Secure Enclave) inaccessible even if your device is compromised. The service stores only the public key, useless to attackers.

This structural separation changes everything. When servers get breached, attackers find nothing useful.

WebAuthn adds another layer: site binding. During registration, the passkey binds cryptographically to the domain. If a phishing site tries to use the passkey, authentication fails; the cryptographic signature won't match the wrong domain. NIST SP 800-63B recognizes this as verifier impersonation resistance, the highest assurance level.

Security becomes automatic. You can't be tricked into typing credentials that don't exist. You can't reuse passwords across sites. You can't fall for fake login pages. The cryptography simply won't cooperate.

Why passkeys are phishing-resistant

Passkeys are cryptographically bound to the specific domain where they were created — for example, google.com. When your browser signs the server's challenge, it includes the domain name in the signed data. If you land on a fake site (g00gle.com), the passkey for google.com simply won't work — the domain doesn't match. There's no password to trick you into typing on a fake page.

This is a property that SMS-based 2FA and even TOTP codes can't offer. Those can be intercepted in real-time phishing attacks. A passkey can't be.

Can passkeys be stolen or hacked?

The private key lives in the device's Secure Enclave (Apple) or TPM (Windows) — hardware-isolated chips designed to be tamper-resistant. Even if malware infects the device, it can't extract the private key from the Secure Enclave. An attacker would also need to pass biometric verification to use the passkey.

Private by design

Passkeys protect privacy as fundamentally as security. Your fingerprint or face scan never leaves your device. Biometric authentication happens locally. The service never sees your biometric data, only that you unlocked the key.

Public-key cryptography also prevents tracking. Each service gets a different public key. Unlike passwords (same credential everywhere) or cookies, passkeys can't link your activity across sites. Google can't see what you do on Microsoft.

This aligns with GDPR principles: minimal data collection, local processing, user control. NIST guidelines similarly emphasize privacy-preserving authentication. With passkeys, you prove who you are without revealing who you are.

What happens if you lose your device?

This is the question that stops most people from switching. Here's the full picture:

• Synced passkeys — iCloud Keychain: Your passkeys are backed up in iCloud Keychain, which is end-to-end encrypted. Apple confirms that Apple itself cannot read your passkeys. Set up a new iPhone, sign in to your Apple ID, and your passkeys restore automatically. Apple's iCloud Keychain escrow system enforces a 10-attempt limit — after 10 failed recovery attempts, the record is permanently destroyed. Two-factor authentication is required on the Apple ID.
• Synced passkeys — Google Password Manager: Sign in to your Google account on a new Android device and your passkeys restore automatically.
• Device-bound passkeys: If you lose a hardware security key, you need a backup. Best practice is to register two hardware keys for every account — keep one as a backup in a secure location.
• Account recovery contacts: Apple, Google, and Microsoft all support recovery contacts and recovery codes. Set these up before you need them.

The real-world benefits of passkeys: 2025–2026 data

The FIDO Alliance Passkey Index (October 2025) aggregates performance data from Amazon, Google, Microsoft, PayPal, TikTok, and five other major platforms. The numbers are striking.

Passkey sign-ins achieve a 93% success rate, compared to just 63% for other authentication methods — a 30-percentage-point gap. In terms of speed, passkeys take an average of 8.5 seconds per sign-in, compared to 31.2 seconds for traditional MFA — a 73% reduction in login time. Organizations report up to an 81% reduction in sign-in-related help desk incidents, primarily password reset requests.

Real-world case studies from the Authenticate 2025 conference reinforce these figures. Roblox achieved a 15% reduction in account takeovers after implementing passkeys in its sign-up flow (Corbado, 2025). TikTok reported a 97% passkey authentication success rate. VicRoads in Australia rolled out passkeys to 5 million users using a phased, data-driven approach.

Consumer adoption is accelerating too. The FIDO Alliance World Passkey Day Consumer Survey (April 2025) found that 69% of consumers have enabled passkeys on at least one account, and 74% are aware of passkeys. The same survey found that 47% of consumers will abandon a purchase if they forget their password — a conversion problem that passkeys eliminate.

Limitations and drawbacks of passkeys

Passkeys solve fundamental security problems but aren't frictionless yet. Cross-device sync is the biggest friction point. Apple syncs through iCloud Keychain, Google through Password Manager, Microsoft through Windows Hello, and these ecosystems don't talk. iPhone-to-Windows needs clunky QR codes.

Account recovery gets trickier. Lose your phone without backups, and you could lock yourself out. Platform providers offer recovery options, but users must enable them proactively.

Legacy system support remains incomplete. Many internal apps, VPNs, and older sites don't accept passkeys. Passwords aren't disappearing overnight.

Current limitations

• The weakest-link problem. Most websites that support passkeys still allow password login as a fallback. This means the account's security is only as strong as the weakest authentication method available. An attacker who can trigger the "forgot password" flow can still bypass the passkey entirely. Until services remove the password fallback, passkeys add a stronger option — they don't eliminate the password attack surface.
• Cross-ecosystem friction. Passkeys stored in iCloud Keychain aren't automatically available on Android, and vice versa. A user switching from iPhone to Android must re-enroll passkeys on the new platform. Password managers solve this by storing passkeys in a platform-agnostic vault, making them the better choice for users who work across multiple ecosystems.
• The bootstrapping paradox. To use a passkey, you need a passkey-capable device. Setting up a new device from scratch still requires another way to authenticate first — typically a password or a recovery code. For enterprise IT teams managing large-scale rollouts, this creates a chicken-and-egg problem: you can't fully eliminate passwords until every user has enrolled a passkey, but enrollment requires the old credentials.
• Limited adoption. As of early 2026, 48% of the top 100 websites support passkeys. The majority of the internet still requires passwords. Passkeys and passwords will coexist for years — which means password management remains a real operational need during the transition.

Platform credential managers — iCloud Keychain, Google Password Manager, Windows Hello — are designed for individual users, not organizations. They don't offer shared vaults, role-based access controls, or audit logs. When an employee leaves, there's no centralized way to revoke their passkeys or rotate shared credentials.

For IT teams managing dozens of systems, that's an operational gap, not a minor inconvenience. Managing that coexistence — passkeys where supported, strong passwords where not — is exactly what Passwork is built for. Structured vaults, granular access controls, and full audit trails keep legacy credentials secure while your team rolls out passkeys at its own pace.

Why organizations still need a password manager

Passkeys solve the authentication problem for supported services. They don't solve the credential management problem for everything else.

Consider what a typical enterprise environment actually contains: dozens of internal tools that won't support passkeys for years, shared service accounts that can't be tied to a single device, API keys and SSH credentials that have no passkey equivalent, and legacy systems where the authentication model is fixed. None of that disappears when you roll out passkeys for Microsoft 365 and Google Workspace.

A corporate password manager handles what passkeys can't:

• Shared credentials — service accounts, admin logins, and team passwords need controlled access with clear ownership. Platform keychains are personal by design; they have no concept of shared vaults or role-based permissions.
• Non-human identities — API keys, SSH keys, database credentials, and CI/CD secrets don't map to a user's biometric. They need a secure home with access controls and rotation policies.
• Legacy systems — internal tools, on-premise applications, and older SaaS products will keep requiring passwords for years. Those credentials need the same security discipline as everything else.
• Offboarding — when an employee leaves, IT needs to revoke access and rotate shared credentials immediately. There's no centralized way to do that across iCloud Keychains or Google accounts.
• Audit trails — SOC 2, ISO 27001, and similar frameworks require evidence of who accessed what and when. Platform credential managers don't produce that log.
• Cross-platform environments — organizations running Windows, macOS, Android, and Linux simultaneously can't rely on any single platform's native sync. A vendor-neutral vault covers the full stack.

The two tools address different layers of the same problem. Passkeys handle user authentication where the standard is supported. A password manager covers the rest — and keeps the whole credential surface auditable.

Which services and platforms currently support passkeys?

All major platforms now support passkeys, though implementation details vary.

Apple stores passkeys in iCloud Keychain, syncing end-to-end encrypted across iPhones, iPads, and Macs. Users can sign in with Face ID or Touch ID, and use their iPhone as an authenticator for non-Apple devices via QR code.

Google integrates passkeys through Google Password Manager on Android and Chrome. Passkeys sync across devices signed into the same Google account, protected by a dedicated PIN or biometric unlock.

Microsoft supports passkeys through Windows Hello, Microsoft Authenticator, and Entra ID. Windows 10/11 devices use biometrics or PIN; the Authenticator app stores device-bound passkeys for enterprise accounts, with optional cloud sync for personal accounts.

The FIDO Alliance certifies implementations, ensuring cross-platform interoperability. Most modern browsers (Chrome, Safari, Edge, Firefox) support WebAuthn, making passkeys usable across operating systems.

Devices and browsers that support passkeys

Passkeys work across modern platforms, but version requirements matter. Here is the current compatibility landscape based on our testing across device combinations.

Key findings from testing:

• Apple's ecosystem syncs seamlessly across Apple devices but needs QR codes for non-Apple hardware.
• Android passkeys sync through Google accounts but need device unlock for access.
• Windows Hello offers device-bound passkeys; cloud sync is still rolling out for personal accounts.
• Cross-platform flows work but feel less polished than within-ecosystem sync.

WebAuthn enables this cross-platform compatibility, browsers implement the standard, so passkeys work across operating systems despite different sync backends.

How to start using passkeys today

Getting started with passkeys takes five minutes. Here is the practical flow based on setting them up across devices.

Apple ecosystem (iPhone, iPad, Mac)

Passkeys on Apple devices are stored in iCloud Keychain and sync automatically across all Apple devices signed in to the same Apple ID. Two-factor authentication must be enabled on the Apple ID.

1. Visit a supported website and go to account settings or the sign-up page.
2. Look for a "Create a passkey" or "Add a passkey" option.
3. Tap the option. The browser prompts you to use Face ID, Touch ID, or your device passcode.
4. Authenticate with your biometric. The passkey saves to iCloud Keychain automatically.
5. On future logins, tap "Sign in with passkey" and authenticate with Face ID or Touch ID.

Android (Google Password Manager)

Passkeys on Android are stored in Google Password Manager and sync across Android devices signed in to the same Google account. When a website offers to create a passkey, Android prompts you to save it to Google Password Manager. Authenticate with fingerprint, face recognition, or your screen lock PIN.

Windows (Windows Hello / Microsoft Authenticator)

On Windows 11, passkeys can be stored in Windows Hello — using the device's TPM chip — or in the Microsoft Authenticator app. Windows Hello passkeys are device-bound by default, which means they qualify as AAL3 under NIST SP 800-63B-4.

When a website offers to create a passkey, Windows prompts you to save it with Windows Hello. Authenticate with your Windows Hello PIN, fingerprint, or face recognition.

Password manager

For organizations managing credentials at scale, a corporate password manager like Passwork provides the infrastructure to handle both legacy passwords and the transition to passkeys — keeping credentials secure and auditable throughout the migration.

Tips from testing:

• Start with services you use daily but aren't business-critical.
• Keep one device as backup before removing passwords.
• Test recovery before you need it.
• Enterprise users should verify compatibility with existing SSO.

Which websites and apps support passkeys?

As of early 2026, major platforms supporting passkeys include: Google, Apple ID, Microsoft, Amazon, PayPal, GitHub, Shopify, Adobe, Uber, TikTok, eBay, Roblox, Coinbase, Best Buy, and many others.

The community-maintained directory at passkeys.directory provides a current, searchable list of every website and app that supports passkeys.

Conclusion

Passwords aren't going away this year. But the direction is clear: 15+ billion accounts already support passkeys, 87% of enterprises are deploying them, and the authentication success rate gap — 93% vs. 63% — makes the case better than any marketing claim could.

Passkeys are available now, on devices people already own, for services they already use. The technology is mature. The standards are settled. The remaining friction is adoption, not capability.

The transition from passwords to passkeys will take years, not months. During that period, most organizations will run hybrid environments: passkeys for some services, passwords for others, service accounts that don't fit either model. The security posture of the whole depends on how well you manage the parts that haven't moved yet.

Passwork is built for this period — structured vaults, access controls, and audit trails that keep legacy credentials under control while passkey enrollment scales across your team.

The shift from passwords to passkeys is a process, not a switch. The organizations that manage it deliberately will arrive at a meaningfully stronger security posture — with less friction for users and fewer incidents for IT teams.

Frequently Asked Questions

Social engineering vs. phishing attacks: Key differences & defense strategies | expert guide

Phishing is social engineering — but social engineering is much more than phishing. Learn the difference, see how AI is reshaping both threats, and build defenses that cover the full attack surface.

Passwork BlogAlex Muntyan

What is Privileged Access Management? A Complete Guide

Privileged accounts are the highest-value targets for attackers. One compromised admin credential gives full control over infrastructure, data, and applications. PAM addresses this through credential vaulting, session monitoring, and least privilege enforcement. Here’s how it works in practice.

Passwork BlogAlex Muntyan

Enterprise Password Management Best Practices: The 2026 Security Guide

If your password policy still mandates 90-day rotations and eight-character minimums, it’s out of date. This guide covers enterprise password management best practices for 2026: policy, privileged accounts, non-human identities, MFA, and compliance.

Passwork BlogAlex Muntyan