Robots Atlas>ROBOTS ATLAS
Security & Privacy

Passkey

2022ActivePublished: 24 October 2026Updated: 24 October 2026Published
Key innovation
Replacing the password with a cryptographic key pair whose private key never leaves the user's device, structurally eliminating phishing, password leaks and replay attacks.
Category
Security & Privacy
Abstraction level
Standard
Operation level
ApplicationSystem
Use cases
Passwordless sign-in to websites and appsPhishing-resistant two-factor authenticationSign-in across consumer ecosystems (iOS, Android, Windows)Enterprise access and security-compliance requirementsGovernment e-service authentication

How it works

1) Registration: when a credential is created, the authenticator generates a unique key pair for the service origin. The private key stays in the device's secure storage, and the public key is sent to and stored by the Relying Party together with a credential ID. 2) Authentication: the server issues a random challenge. The user unlocks the private key locally with device biometrics or a PIN (user verification). The authenticator signs the challenge with the private key and returns the signature. 3) Verification: the server validates the signature using the stored public key. The private key never leaves the device. The browser and operating system bind the credential to the service origin, so it cannot be used on a phishing site. In WebAuthn, a credential that allows username-less sign-in is called a discoverable credential (resident key).

Problem solved

It addresses the systemic weaknesses of password-based authentication: susceptibility to phishing, mass breaches of password databases, password reuse across services, replay attacks and weak passwords. Because the server stores only the public key, a breach of it does not let an attacker impersonate the user.

Components

Private keySigns the authentication challenge; never leaves the device

The secret key of the pair, kept in the device's secure storage; unlocked locally with biometrics or a PIN.

Public keyVerifies the signature; stored by the service

The public key of the pair, stored by the service along with a credential ID. Leaking it does not allow user impersonation.

AuthenticatorGenerates and stores keys, performs user verification

A hardware or software component (platform, e.g. phone/laptop, or roaming, e.g. a security key) responsible for generating keys and signing challenges.

Platform authenticatorBuilt into the device (phone, laptop).
Roaming authenticatorExternal, e.g. a hardware security key (USB/NFC/BLE).

Official

WebAuthn APIBrowser interface for creating and using credentials

The W3C-standardised browser API mediating between the service and the authenticator (the create and get ceremonies).

CTAPProtocol for client-to-external-authenticator communication

Part of FIDO2; defines communication between the client (browser/OS) and a roaming authenticator (e.g. a security key).

Implementation

Reference implementations
SimpleWebAuthn
TypeScript · Matthew Miller (MasterKale)
java-webauthn-server
Java · Yubico
Implementation pitfalls
Account recovery when a device is lostHigh

With device-bound passkeys, losing the device can lock the user out; recovery mechanisms or backup credentials are required.

Fix:Register multiple authenticators, offer synced passkeys and fallback recovery paths.
Origin and RP ID validationHigh

Phishing resistance relies on correct server-side validation of the origin and Relying Party ID; misconfiguration weakens security.

Fix:Strictly validate origin, RP ID and challenge per the WebAuthn specification.
Inconsistent platform support and UXMedium

Passkey behaviour differs across operating systems, browsers and password managers, complicating a consistent UX and cross-ecosystem portability.

Fix:Test on target platforms and provide fallback sign-in paths.

Evolution

Original paper · 2021 · W3C Recommendation
Web Authentication: An API for accessing Public Key Credentials Level 2
2019
WebAuthn Level 1 becomes a W3C Recommendation
Inflection point

On 4 March 2019 the W3C publishes WebAuthn Level 1 — the public-key credential API that is the technical foundation of passkeys.

2021
WebAuthn Level 2 becomes a W3C Recommendation

On 8 April 2021 the W3C publishes WebAuthn Level 2, extending the public-key credential specification.

2022
FIDO Alliance: Multi-Device FIDO Credentials (synced passkeys)
Inflection point

In March 2022 the FIDO Alliance publishes a white paper on multi-device FIDO credentials, outlining the synced-passkey concept.

2022
Apple, Google and Microsoft commit to passkey support
Inflection point

In 2022 Apple, Google and Microsoft announced expanded support for passkey sign-in across their platforms and browsers, popularising the "passkey" branding.

2026
WebAuthn Level 3 becomes a W3C Recommendation

On 25 August 2026 the W3C publishes WebAuthn Level 3, the latest version of the public-key credential specification.

Hyperparameters (configurable axes)

Authenticator attachmentHigh

platform (built into the device) or cross-platform / roaming (external hardware key).

platform
cross-platform
Discoverable credential (resident key)High

Whether the credential is discoverable (enables username-less sign-in): required / preferred / discouraged.

required
preferred
discouraged
User verificationHigh

Requirement for local identity confirmation (biometrics/PIN): required / preferred / discouraged.

required
preferred
Signature algorithmMedium

The credential's cryptographic algorithm encoded in COSE, e.g. ES256 (ECDSA P-256) or RS256.

ES256
RS256
SyncabilityMedium

Whether the credential is synced across devices (synced passkey) or bound to one device (device-bound).

synced
device-bound