Passkey

Passkeys are built on the FIDO2 specifications, WebAuthn and CTAP, and WebAuthn covers the browser API that manages them. A passkey can be stored on a phone, a computer, or a hardware security key. To sign in, the user approves the request with the biometric, PIN, or device password that unlocks the device. Biometric data stays on the device and is never sent to a remote server, which only receives an assurance that the check succeeded.

Passkeys come in two forms. Synced passkeys are copied across a user's devices through a cloud service run by a passkey provider, either the credential manager built into a browser or operating system or a third-party app, and the FIDO Alliance states that this syncing is end-to-end encrypted. Device-bound passkeys never leave a single device, as on a FIDO security key. NIST SP 800-63B calls authenticators whose keys are copied through a sync fabric syncable authenticators, notes that many are built on WebAuthn, and requires keys in the sync fabric to be stored encrypted and protected by AAL2-equivalent MFA.

Passkeys are phishing-resistant, always strong, and designed so that there is no shared secret to steal, which reduces phishing, credential stuffing, and other remote attacks. Their main use is to replace the password as the primary sign-in factor, and they can also replace older MFA flows such as a password plus an SMS code. The UK NCSC recommends making passkeys the first choice of login wherever they are offered.

Syncing requires the private key to be exportable, so NIST does not allow syncable authenticators at its highest authentication assurance level, AAL3, though they may be used at AAL2. WebAuthn flags tell a relying party whether a credential is eligible to be synced and whether it has been synced, and a verifier may use them to restrict syncable authenticators.