If you’re here reading this article, you’ve probably heard about passkeys and that it’s here to rid the world of the malice that is passwords.
But, what exactly are they, and how do they work?
Whether you’re a designer, product manager, or developer looking for a simplified high-level view, this article will provide a foundational understanding of passkeys and where they fit in the authentication landscape.
This is the starter kit I wish I had when I first started working with passkeys
Passkeys are a device-led experience. So, it is important to understand at least the basics to be able to design for them.
When we implemented passkeys for an NHS service, most of the available information was highly technical, with very few real-world examples. We had to learn by testing, experimenting, and researching.
What passkeys are NOT
A common misconception I’ve noticed when people are first introduced to passkeys is the assumption that passkeys are the same as biometrics.
Passkeys are not biometrics
- Biometrics unlock a device to access stored credentials
- Passkeys are the credentials stored on the device
It is important to make this distinction, especially for services where different authentication methods coexist.
Biometrics, like fingerprints and facial recognition, are methods of verifying a user. They are ways for a user to say ‘I am the owner of this device, grant me access to everything stored on it’. You can use biometrics to verify access to a passkey, but they are separate concepts.
What actually is a passkey?
Simply put, passkeys are a replacement for passwords. Passwordless authentication is another term used to describe them.
Unlike biometrics, it is correct to directly compare passkeys to passwords. However, instead of being made up of words, numbers, and symbols, passkeys are cryptographic keys.
A passkey is part of a cryptographic key pair:
- Private key which is the passkey itself
- Public key
This is a very simple visual representation but you can think of them like a matching key and padlock that work together to verify authentication.
Passkey creation
When a user creates a passkey, their device generates a cryptographic key pair. Each key pair is unique to the service and the user account it is created for.
- Private key (passkey): Stored securely on a user’s device and never shared
- Public key: Stored by the service the user is logging into
Cryptography in simple terms
It is a way of securely hiding and protecting information so that only the right people can access it. It works like a secret code or language that scrambles data, making it unreadable to anyone who doesn’t have the public key to unlock it.
Passkey authentication
During a passkey login, a three-way conversation takes place between the user, the service, and the device.
Here’s what that communication looks like from the backend POV:
- User selects to log in with a passkey.
- Service finds the public key linked to the user’s account and sends an authentication challenge to the user’s device.
- Device prompts the user to verify themselves before accessing the passkey.
- This could involve biometrics, a pattern, a PIN, etc.
- User verifies themselves using their preferred method (biometrics, PIN, pattern, etc.)
- Device signs the challenge using the private key (passkey) and sends it back to the service.
- Service verifies the signature using the stored public key.
- If the signature from the private key matches the public key, authentication succeeds and the user logs in.
Where biometrics fit in this process
This should help clarify where biometrics fit into the process of passkey authentication. Biometrics are one of the methods the user can use to verify themselves before accessing the passkey. However, the actual authentication happens later in the process, when the service verifies the signature using the public key.
Cross-platform syncing
A key advantage of passkeys is their ability to sync across devices. This is also what makes account recovery much easier with passkeys.
If a user has enabled iCloud Keychain, logged into a Google account, or uses any other password manager service like 1Password, they have the option to store and sync their passkeys across devices using that cloud provider.
If a user selects to save their passkey to their cloud account, the device encrypts the passkey. The device shares the encrypted metadata with the cloud service while the passkey itself remains secure on the device.
The entire process is end-to-end encrypted. The cloud provider never sees or reads or accesses the actual passkey.
Synced passkeys
Synced passkeys are essentially roaming credentials, allowing users to access them on any device as long as they are signed into the same cloud account.
The cloud acts as a bridge, enabling seamless access to the passkey anywhere and anytime. A synced passkey is not automatically stored on every device—instead, it remains encrypted in the cloud and is retrieved securely when needed.
Device-bound passkeys
If a user chooses to save the passkey to a security key or the device itself, then the passkey will be stored only on that single device.
Passkeys as two-factor authentication
2FA enhances security by requiring two separate forms of identification to verify a user. A passkey meets this criteria on its own, without the need for multiple steps, effectively replacing both the password and OTP.
The traditional 2FA involves:
- Something you know: password
- Something you have: a phone for receiving an OTP
Passkeys as 2FA involves:
- Something you have: private key (passkey)
- Something you are/know: biometrics, PIN, pattern or passcode
I’ve come across services that implement passkeys as an alternative to OTP, still asking for a password. While there are no rules in terms of how a service can utilise a passkey, such ways of implementation defeats the whole purpose of passkeys.
Recap
- Private key is the passkey itself and stored on the device
- Passkey is end-to-end encrypted and never leaves user’s device
- Public key is not a secret and it is useless without the private key
- Passkeys are generated using asymmetric cryptography (one-way math) making it impossible for bad actors to reverse engineer the public key to figure out the private key
- The service or the cloud provider never sees or accesses the actual passkey
- No sensitive personal data (i.e. biometrics, full name or address, or payment details) is stored with the private key or the public key
- Authentication happens through the interaction of both keys — the private key signs data, and the public key confirms the signature is valid
Conclusion: The future of authentication
Passkeys represent a significant step forward in secure authentication. By eliminating passwords and relying on cryptographic security, they provide a seamless, user-friendly way to log in without compromising security. As adoption increases, passkeys have the potential to become the standard authentication method, making our digital experiences safer and more convenient.
