Skip to content
Know.itKnow.it
Create an animated lesson
On request

This article is free to read. Creating a lesson uses your daily or stored credits; review the language and settings before starting.

How do passkeys work?

TechnologyLesson on requestFree to readयह पेज हिंदी में पढ़ें

Quick answer

Passkeys are a password replacement that uses a pair of cryptographic keys: a private key stored securely on your device and a public key held by the website. When you sign in, your device signs a challenge with the private key, and the website verifies it with the public key, so no secret is ever transmitted.

Passkeys replace passwords by storing a cryptographic key pair: the private key stays with you, on your device or in an encrypted synced keychain, while the public key is kept by the website. When you sign in, your device proves it holds the private key without ever sending it over the internet.

Step by step

  1. You create an account or add a passkey on a website, and your device generates a unique key pair.
  2. The private key is stored securely on your device, protected by your fingerprint, face, or PIN.
  3. The public key is sent to the website and stored alongside your account information.
  4. When you sign in, the website sends a random challenge to your device.
  5. Your device signs the challenge with the private key and returns the signature to the website.
  6. The website verifies the signature using your public key and grants access if it matches.

Key things to understand

  1. A passkey is a cryptographic key pair generated by your device for a specific website or app.
  2. The private key is never sent to the website and is unlocked by your fingerprint, face, or PIN.
  3. The website stores only the public key, which cannot be used to impersonate you.
  4. To sign in, the website sends a random challenge that your device signs with the private key.
  5. The website verifies the signature using the public key, confirming you hold the private key.

Labelled diagram

  1. Key generation

    Your device creates a unique private and public key pair for the website.

  2. Public key shared

    The public key is sent to the website and stored with your account.

  3. Challenge sent

    When you sign in, the website sends a random challenge to your device.

  4. Signature created

    Your device signs the challenge using the private key, unlocked by biometrics.

  5. Verification

    The website checks the signature with the public key and grants access.

How a passkey sign-in works

Real-world examples

  • Google allows you to create passkeys for your Google Account and sign in using your phone's fingerprint or face unlock.
  • Apple's iCloud Keychain syncs passkeys across iPhone, iPad, and Mac, letting you sign in to websites without typing a password.
  • Microsoft Windows Hello lets you use a PIN or biometric to sign in to supported websites with passkeys.
  • PayPal supports passkeys so you can log in using your device's biometrics instead of a password.

Common mistake

✗ Myth: Passkeys are just passwords stored in your browser.

✓ Fact: Passkeys are not passwords at all; they are cryptographic key pairs. The private key is never sent to the website, and the website only stores a public key that cannot be used to sign in.

People also ask

What is a passkey and how does it work?
A passkey is a digital credential that replaces passwords. It works by creating a key pair: a private key on your device and a public key on the website. When you sign in, your device proves it has the private key without revealing it, so there is no password to steal or guess.
Are passkeys safer than passwords?
Yes, passkeys are generally safer because they are resistant to phishing and cannot be reused across sites. Since the private key is never shared with the website, there is no shared secret that can be leaked in a data breach. However, you must protect your device and its unlock method.
How do I set up a passkey?
To set up a passkey, go to your account settings on a supported website and choose the option to create a passkey. Your device will prompt you to authenticate with your fingerprint, face, or PIN. The passkey is then stored securely and can be used for future sign-ins.
What happens if I lose my device with the passkey?
If your passkeys are synced to a cloud account, you can recover them on a new device by signing in to that account. Otherwise, you may need to use a backup method or contact the service to regain access.
Are passkeys more secure than passwords?
Yes, because there is no shared secret to steal or guess. Passkeys are resistant to phishing, since they are bound to the website's origin and cannot be replayed on a fake site.
Can I use passkeys on multiple devices?
Yes, if your passkey provider syncs them across devices through your cloud account. Some services also let you register multiple passkeys, such as one for each device you own.
Do passkeys work without an internet connection?
The authentication process requires communication with the website, so an internet connection is needed. However, the private key itself is stored locally and does not require the internet to be accessed.

Part of the guide: How the Internet Works →