Passkeys Explained: WebAuthn, FIDO2, and Why Passwords Are Obsolete

Passkeys: The End of Passwords as We Know Them

Every time you type a password, you're trusting two things: that you'll never reuse it, and that the server won't get hacked. Both assumptions are wrong. Passkeys fix this by replacing shared secrets with asymmetric cryptography — the same tech behind SSH keys.

How Passkeys Work

When you create a passkey on a site, your device generates a public-private key pair. The private key stays in a secure chip (Secure Enclave on iPhone, TPM on Windows, or a YubiKey). The public key is sent to the server. To log in, the server sends a challenge (a random number), your device signs it with the private key, and the server verifies the signature with the public key. No secret ever leaves your device.

Here's the registration flow using the WebAuthn API:

const credential = await navigator.credentials.create({
  publicKey: {
    challenge: new Uint8Array(32), // from server
    rp: { name: "My Site", id: "mysite.com" },
    user: {
      id: new Uint8Array(16),
      name: "user@example.com",
      displayName: "User",
    },
    pubKeyCredParams: [{ alg: -7, type: "public-key" }], // ES256
    authenticatorSelection: { userVerification: "required" },
  },
});

And the authentication flow:

const assertion = await navigator.credentials.get({
  publicKey: {
    challenge: new Uint8Array(32), // from server
    userVerification: "required",
  },
});

The browser handles biometric or PIN verification. The server verifies the signature using libraries like @simplewebauthn/server.

Why Passkeys Are More Secure

Feature	Password	Passkey
Secret shared with server	Yes	No (only public key)
Reusable across sites	Often	No (domain-bound)
Phishing-resistant	No	Yes (cryptographically bound to domain)
Leak-proof on server	No (hashed, but still vulnerable)	Yes (public key is useless to attackers)

Passkeys are bound to the exact domain. Visiting paypa1.com instead of paypal.com won't trigger a passkey — the browser checks the domain, not you.

What Happens If You Lose Your Phone?

Since 2022, Apple, Google, and Microsoft sync passkeys across devices:

• iOS/macOS: iCloud Keychain
• Android/Chrome: Google Password Manager (end-to-end encrypted)
• Windows: Windows Hello (limited cross-device sync)

If you lose your phone, restore iCloud or Google account on a new device, and passkeys come back. For extra safety, use a physical security key (e.g., YubiKey) as a backup — it doesn't sync but works on any device.

Services Already Using Passkeys

Google, Apple, GitHub, Microsoft, PayPal, Amazon, X, and many others support passkeys. Google made them default for personal accounts. Look for "Passkey" or "Security Key" in account settings.

Flow to create a passkey:

1. Go to security settings.
2. Click "Add a passkey" or "Create a passkey".
3. Confirm with Face ID, Touch ID, Windows Hello, or phone PIN.
4. Done. Next login: no password needed.

Third-party password managers like ProtonPass also support passkeys, encrypted end-to-end.

The Bottom Line

Passkeys aren't just passwords behind biometrics. They're a complete model change: nothing to remember, nothing to steal. If a service offers passkeys, use them. It's strictly more secure and faster than any password.