How Passkeys Actually Work (and Why They're So Hard to Phish)
Updated: Oct 24
You've probably seen the prompt by now: "Create a passkey for faster, safer sign-in?" Apple, Google and a growing list of websites keep offering it, but most people tap yes or no without knowing what they just agreed to. In this post, we'll walk through what a passkey actually is, what happens behind the scenes when you sign in with one, and why security agencies see it as a big step up from passwords.
What a passkey is (and isn't)
Google's developer documentation describes a passkey as "a digital credential, tied to a user account and a website or application." Apple puts it more bluntly: passkeys "are a replacement for passwords." The FIDO Alliance, the industry group that wrote the underlying standards, adds that a passkey can live on your phone, your computer, or a hardware security key.
Here's the part that trips people up. A passkey isn't your fingerprint, your face, or your phone's PIN. Those are just how you unlock the passkey on your device, the same way you already unlock the device itself. The passkey itself is a pair of cryptographic keys, which are really just very long numbers with a special mathematical relationship.
The two keys behind every passkey
When you create a passkey for a site, your device generates two matching keys. Apple's security guide explains that one of them is public and is stored on the website's server, and that "this public key is not a secret." The other is private. It stays with you, on your device or in your password manager, and as Apple puts it, "the server never learns what the private key is."
This approach is called public-key cryptography. The idea is that something locked or signed with the private key can be checked with the public key, but the public key can't be used to work backward and recreate the private one. Google's documentation says it plainly: an attacker "can't derive the user's private key from the data stored on the server."
Signing in then works like a quick quiz. According to Mozilla's developer docs (MDN), the website sends your device a very large random number called a challenge. Your device signs that challenge with your private key and sends the signed version back. The server checks the signature using the public key it saved earlier. If it matches, you're in. That proves you hold the private key, as MDN notes, "without revealing any secrets over the network." Because the challenge is random and changes every time, an old signed answer is useless to anyone who copies it.
Think of it like an old-fashioned signet ring. You're the only one with the ring, and it never leaves your hand. The bank keeps a wax impression of your ring on file. Each time you visit, the teller hands you a fresh, random note, and you stamp it with the ring. The teller compares the stamp to the impression and lets you in. A thief who steals the impression from the bank's files can't make a ring from it, and an old stamped note won't help either, because tomorrow's note will be different.
Why passkeys are so hard to phish
Phishing usually works by tricking you into typing your password into a fake site that looks like the real one. Passkeys take you, the human, out of that decision. Google explains that passkeys "are bound to a website or app's identity," and that "the browser and operating system ensure that a passkey can only be used with the website or app that created them."
So if you land on a convincing fake of your bank's site, your device simply won't offer your bank's passkey there. MDN describes the result: an attacker who builds a fake login site "can't login as the user because the signature changes with the origin of the website." (The origin is the site's exact web address.) There's no password to type, so there's nothing to hand over.
That's why the U.S. Cybersecurity and Infrastructure Security Agency (CISA) says "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication," the standards passkeys are built on. CISA urges organizations to start planning a move to FIDO because, when someone is tricked into logging into a fake website, "the FIDO protocol will block the attempt."
Passkeys also take the sting out of data breaches. When a company's password database leaks, attackers can try those passwords on other sites. With passkeys, the company only stores public keys, which aren't secret. Google notes there's "far less value for a bad actor to hack into servers" when there are no passwords to steal. And since every passkey is unique to one service, there's nothing to reuse.
Syncing, new phones, and signing in on other devices
A fair worry is what happens if you lose your phone. Most passkeys today sync through a password manager. Apple says passkeys sync across your devices using iCloud Keychain, which is end-to-end encrypted with keys Apple doesn't know, and that they're recoverable even if you lose all your devices. Google says its Password Manager encrypts passkeys end-to-end too, so even though they're backed up to Google's servers, Google can't use them to pretend to be you.
What about a computer that doesn't have your passkey, like a library PC or a friend's laptop? Google explains that a passkey on your phone can still sign you in there, as long as the phone is near the computer and you approve the sign-in on the phone. Your passkey stays on your phone the whole time; the laptop just gets the signed answer.
And your biometrics stay put. Google states that "biometric material never leaves the user's personal device." The website never sees your fingerprint or face. It only gets a signed challenge.
Want the video version? KP breaks down identification, authentication, authorization and accountability in under 3 minutes:
What this means for you
Say yes to passkeys on important accounts first: email, banking, and your Apple, Google or Microsoft account. Your email is the key to resetting everything else.
Keep your password manager account well protected, since that's where synced passkeys live. A strong device PIN and up-to-date software go a long way.
Don't panic if a site still asks for a password as a backup. Many services keep one around during the transition. Where you can't use passkeys yet, CISA's advice still applies: any multi-factor authentication is better than none.
If you run IT for a business, passkeys and other FIDO methods are the phishing-resistant option CISA recommends planning toward.
You're in good company if you're still getting started. A 2024 survey commissioned by the FIDO Alliance found that 53% of people reported enabling passkeys on at least one account, with 22% turning them on for every account they could.
The bottom line
Passkeys swap a secret you have to remember and type for a key pair your device handles quietly in the background. The website keeps a harmless public key, your device keeps the private one, and fake sites can't fool your browser into using it. The next time you see that "create a passkey" prompt, you'll know exactly what you're agreeing to, and it's worth saying yes.
