Passkey

A passkey is a method for signing in to an online service without typing a password. Instead of a word you have to remember, your own phone or laptop stores a long secret string of numbers. This string of numbers never leaves the device. When you sign in, the service asks your device for proof, and the device responds with a computation that is only possible with this secret. To allow this, you must first authenticate yourself on the device, usually with a fingerprint, face scan, or the screen lock. The service itself never gets to see the secret.

Why passwords are the weakest link

Passwords have two fundamental problems that can’t be trained away. First, the provider has to store something in order to check the password. If its server is hacked, millions of accounts are at risk in one fell swoop. Second, you can give away a password without even noticing. That’s exactly what phishing targets: a fake login page that looks like the original and captures whatever you enter.

A passkey removes the basis for both attacks. On the provider’s server there is only the public part of the key pair, which alone is not enough for anyone to log in. A theft of this data is therefore far less dangerous. And the login is tightly bound to the real site’s internet address. On a cloned fraud site, the device simply refuses to authorize, because the address doesn’t match.

There’s also a practical reason. Many people use the same password for multiple services, because nobody can remember thirty different ones. A single leak then drags down all the other accounts with it. Passkeys are different for each service and are managed by the device, not by memory.

The principle of the two keys

Technically, a passkey is based on a key pair made up of two related numbers. The private key stays secret on your device. The public key is sent to the provider during setup and is fine to be known publicly. Whatever was computed with the private key can be verified with the public one. The reverse doesn’t work: calculating the private key from the public key is practically impossible.

The login process takes the blink of an eye. The service sends a random number, called a challenge. Your device signs this number with the private key and sends the signature back. The service verifies it using the public key. Because the random number is new every time, an intercepted response is useless to an eavesdropper.

A common misconception: the fingerprint is not sent to the provider. It only unlocks the key locally on your device. Biometrics here are the door handle, not the ID card. That’s why a regular device PIN works just as well instead.

Passkeys on phone, laptop, and in everyday life

Major providers have long since built in passkeys. Google, Apple, Microsoft, Amazon, PayPal, and WhatsApp support them, as do many online shops. On the iPhone they end up in the iCloud Keychain, on Android in Google Password Manager, and apps like 1Password or Bitwarden offer their own storage as well. Passkeys are synced across your devices through these accounts.

In practice, you can recognize a passkey by the fact that no password field appears after you enter your email address. Instead, a window pops up asking for a fingerprint or PIN. If you want to sign in on someone else’s computer, the page often shows a QR code. You scan it with your phone, which holds the key, and you’re in.

One open question is what happens if you lose your device. That’s why you should always set up a second option, such as a passkey on another device or recovery codes. Security agencies like Germany’s BSI now explicitly recommend passkeys. In business news, they usually come up in connection with banks, online fraud, or new EU rules on digital identity.