What it means
A passkey replaces a reusable shared password with a key pair created for a particular service. The private key is protected by the user's device or credential provider, while the service stores a public key. Some passkeys are device-bound; others can synchronize securely across a user's devices.
How it works
The user unlocks the authenticator with a local gesture such as a PIN, fingerprint, or face check. The authenticator signs a challenge bound to the legitimate service. The service validates the signature without receiving a secret that can be replayed at another site.
A user selects a saved passkey for a banking site and approves with the device's local unlock. A look-alike phishing site cannot request a valid assertion for the bank's real relying-party identifier.
Practical focus
- Offer more than one recovery and enrollment path without reintroducing weak bypasses
- Explain where credentials are stored or synchronized
- Support users who change or lose devices
- Retain strong controls for privileged and shared-workstation scenarios
Common mistakes
- Calling any biometric login a passkey
- Assuming synchronized credentials fit every regulated or high-assurance use case
- Leaving password recovery as the easiest way around phishing resistance
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: