Auth
Passkeys
Passwordless sign-in on public keys: the private key stays on the device and biometrics or a PIN confirm it.
What it is
A passkey is a credential based on WebAuthn (a W3C standard, Level 1 since 2019) and the CTAP protocol from the FIDO Alliance. On registration the device creates a key pair: the public key goes to the server, the private key stays in secure storage.
Sign-in is signing a random challenge with the private key after unlocking with biometrics or a PIN. The server verifies the signature with the public key. There is nothing on the server to steal and reuse.
Passkeys resist phishing because they are bound to the domain. Apple, Google and Microsoft sync them across devices through iCloud Keychain, Google Password Manager and Windows Hello.
Use it when
- You want to drop passwords and lower phishing and leak risk.
- You need fast sign-in on mobile devices.
- As the main or an additional factor next to existing sign-in.
Avoid it when
- As the only sign-in method with no account recovery fallback.
- Environments with old browsers and devices lacking WebAuthn support.
Key concepts
- WebAuthn
- The browser API
navigator.credentialsfor creating and asserting keys. - Challenge
- A random server value that the device signs.
- Relying Party
- Your service, bound to a domain (RP ID).
- Synced vs device-bound
- A passkey synced across devices, or bound to one.
Example
Interview questions
1. Why are passkeys phishing resistant?
The key is bound to the domain (RP ID). A fake site on another domain cannot get a signature, even if the user tries to sign in.
2. What does the server store?
Only the public key and a credential id. A leak of that database does not allow signing in to accounts.
3. What if the device is lost?
Synced passkeys are available on the user's other devices. You also need a recovery fallback: email, another passkey or a security key.
Interview questions from the bank
Related technologies
- OAuth 2.0A delegated authorization standard: an app gets limited access to a user's resources without their password.
- OpenID ConnectAn authentication layer on top of OAuth 2.0: the client receives an ID token with user information.
- ClerkA managed authentication service with ready React components for sign-in, profile and organizations.
- Auth0A managed authentication and authorization service: sign-in, SSO, MFA and API access with no identity server of your own.
- KeycloakAn open source identity and access management solution with SSO, OIDC, SAML and roles.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).