What is a passkey?
A passkey is a sign-in method based on the WebAuthn standard, developed by the FIDO Alliance and the W3C. When you create a passkey on a site, your device generates a key pair just for that site: the private key stays with you (on your device or in your password manager), and the public key is registered with the site.
When you sign in, you don’t type a password. Your device confirms it’s you with Face ID, a fingerprint, a PIN or your screen lock, then uses the private key to sign a one-time “challenge” sent by the site. The site checks that signature with the public key and lets you in.
Passkeys are supported in Apple, Google and Microsoft operating systems, as well as in many password managers.
How is a passkey different from a password?
A password is a secret that both you and the site know. The site stores a hash of your password, and every time you sign in you send the secret itself. With a passkey, the secret never leaves your device, and the public key stored by the site is useless on its own.
- Resistant to breaches: Even if the site’s database is stolen, it only contains public keys, and those can’t be used to get into your account.
- Resistant to phishing: A passkey is bound to the domain it was created for. On a fake page like “yourbank.com.sign-in-now.xyz” the passkey simply never comes into play, so there’s no way to be tricked into handing it over.
- Can’t be reused: Every site gets its own key pair, so the problem of password reuse disappears.
- Nothing to remember: Signing in is as quick as unlocking your phone or computer.
How do passkeys work under the hood?
Passkeys rely on public-key (asymmetric) cryptography. The process has two stages:
Registration
The site asks your browser for a new passkey. Once your device has verified you, it generates a key pair tied to that site and your account. The public key is sent to the site; the private key stays on your device or in the password manager that stores your passkeys.
Sign-in
The site sends a random value (the challenge). Your browser checks that the request really comes from the registered domain. When you approve with biometrics or a PIN, the private key signs that value and the site verifies the signature with the public key. No secret ever travels over the network.
Where are passkeys stored?
Passkeys can be kept in two ways:
- Synced passkeys: Stored in a password manager or your operating system’s keychain and synced, encrypted, to all your devices. Even if you lose your phone, your passkeys aren’t lost.
- Device-bound passkeys: Kept on a hardware security key or a single device and can’t be copied. They’re a good fit for accounts that need very high assurance, but you’ll need a backup sign-in method in case you lose the device.
The advantage of keeping your passkeys in a password manager is that you can bring different ecosystems (for example, an iPhone and a Windows computer) together in one vault.
What are the limitations of passkeys?
Passkeys are spreading fast, but they aren’t everywhere yet. Here’s what to keep in mind:
- Not every site supports passkeys, so for most accounts you’ll keep using a password and 2FA for a while.
- Many sites keep a password as a fallback sign-in method alongside the passkey. That password needs to be strong and unique too.
- Moving passkeys between products isn’t always possible. If needed, you can create a new passkey from the site’s account settings.
- Keep your account recovery options (backup email, recovery codes) up to date.
How do you use passkeys with KeyZula?
KeyZula stores your passkeys in the same vault as your passwords, end-to-end encrypted, and syncs them to all your devices:
- With the browser extension (Chrome, Edge, Brave, Firefox, Safari) and the iOS and Android apps, you can create passkeys on websites and sign in with them.
- When you choose “Create a passkey” on a site, KeyZula adds the item to your vault; from then on, approving with biometrics or a PIN is all it takes to sign in.
- You can also sign in to your KeyZula account itself with a passkey, so you don’t need to type your master password on trusted devices.
For more details, see our passkey features.
Frequently asked questions
Will passkeys completely replace passwords?
In the long run, passkeys are expected to replace passwords for many accounts, but not every site supports them today. For a while longer, passwords and 2FA codes will be used alongside passkeys.
If I lose my phone, do I lose my passkeys too?
Not if your passkeys are stored in a password manager or a synced keychain: once you sign in to your account on your new device, you can use them again. Only passkeys bound to a single device are lost along with that device.
Does a passkey send my biometric data to the site?
No. Face ID or your fingerprint is used only on your device, to give permission to use the passkey. The site receives a cryptographic signature, never biometric data.
Does storing passkeys in KeyZula cost anything?
No. Every KeyZula feature is free, including storing passkeys and signing in with them.
Can I use passkeys on sites that also have a password?
Yes. Many sites let you add a passkey while keeping your password as a fallback. In that case, make sure the fallback password is strong and unique, and keep your recovery options up to date.