Passkeys Explained: How Passwordless Authentication Works

Passwords have protected online accounts for decades, but they're also one of the weakest links in modern cybersecurity. Passkeys are on the other side - they offer a different approach. Instead of relying on passwords, they use public-key cryptography and your device's built-in authentication methods. 

The utopian world of passwordless cybersecurity lures us in, but is it really possible to get rid of passwords altogether? Is it even safe? How would it work, exactly? Read this article to find out.

Key Takeaways:

• Passkeys replace passwords with cryptographic keys stored securely on the user's device.
• They offer stronger protection against phishing, credential theft, and password reuse.
• Users authenticate with familiar methods like Face ID, fingerprints, or a device PIN.
• Passkeys improve both security and user experience by making sign-in faster and simpler.
• They work across modern devices and are supported by Apple, Google, Microsoft, and the FIDO Alliance.
• While implementation requires some effort, using established authentication solutions can significantly reduce development time.

What are Passkeys?

Passkeys are a passwordless authentication method typically used for sign-in – examples of which I will present later in the piece. It replaces traditional passwords with public key cryptography stored securely on the user's device. It utilizes the built-in security features of modern devices, such as biometrics (fingerprints, facial recognition) or device PINs, to verify user identity.

Essentially, Passkeys allow users to sign in to websites and apps with the same process they use to unlock their device. It’s a fusion of the digital and the material, combining your PIN or face ID with what's physically inside your device.

The rise of Passkeys - why are Passkeys replacing passwords?

The need for stronger cybersecurity is ever-increasing, as bad actors keep pace with the ever-expanding cunning of cybercriminals. Passwords have proven to be faulty and phishing-prone; hence, the initiative to develop a safer authentication method for everyday users in the digital world.

Passkeys are recognized by major tech companies we have all heard of, including Apple, Google, and Microsoft. It’s a testament to the validity, innovation, and capability of this method. It’s also been standardized by the FIDO Alliance, which is an industry consortium dedicated to developing strong authentication standards.

The aim was to eliminate password vulnerabilities, make the login process even more user-friendly, and enhance online security with strong cryptographic methods. On top of that, thanks to biometric technology in non-mobile devices such as laptops, we can apply well-known mobile security practices on the web.

Passkeys are just one piece of a modern authentication strategy. If you're looking for a broader overview of registration, login, and related topics, check out our article, "Authentication & Registration Best Practices."

How do Passkeys Work?

Now that we have a good understanding of the background of Passkeys, let’s get into some technical details on how exactly they work.

Public Key Cryptography

Passkeys use public-key cryptography, a very clever way to ensure cybersecurity.

First, a pair of mathematically linked keys is created – one key is public for decryption, and the other is private for encryption. The public key is available to the app or website, and the private key is safely stored on your physical device, for instance, in a cryptoprocessor called TPM – Trusted Platform Module.

For authentication to work, the process must recognize the pair as a match. In other words, if someone knew everything about you but didn’t have your phone, they wouldn’t be able to log into your account, as they lack the unique private key that’s on your device.

As a consequence, the process cannot be compromised or intercepted digitally – unless someone physically steals your device. There’s no secret actually shared or sent between the involved parties, thanks to those cryptographic keys.

How to set up a Passkey

Let’s make it a bit more visual. Imagine you want to start using a Passkey to authenticate when logging in to your email account. How would you go about it?

The first key point is that the service provider must recognize Passkeys as a valid authentication method. More and more companies are getting on board, but it’s still far from all of them. However, if you use Apple, Microsoft, or Google, you’re good to go! Moreover, you will need to set up a Passkey for each service you use, just as you would with a password. While that ought not to be surprising, I reckon it’s worth pointing out.

Now you should be able to find a button to set up a Passkey for the account. Then, the system will instruct you to create a verification that you’d input as a user, such as a shape, a PIN, or, even more conveniently, biometrics. After you’ve done so, the device generates a unique public/private key pair. The public key is registered with the service provider, and the private key is stored securely on your physical device.

Authentication Process

Once you’ve got everything set up, how would the actual authentication process work in practice?

1. Users initiate login.
2. The service presents a challenge to the user's device.
3. The user authenticates on their device using their preferred method (biometrics, PIN, or pattern).
4. The device uses the private key to sign the challenge, creating a cryptographic proof of ownership.
5. The device transmits this signed response to the service.
6. The service verifies the signature using the previously registered public key.

From your perspective, the user, you literally just:

1. Click on the login button
2. Click on Passkey as the method
3. Enter your PIN/Face ID

And that’s it. It’s insanely simple and smooth. On top of that, you are not required to remember anything at any point, so nothing can really go wrong.

Are Passkeys more secure than passwords?

This is the question that people often ask themselves, having been so accustomed to passwords.  The short answer is yes! A slightly longer answer is that not only are they safe, but they are significantly safer than passwords are. This leads us to the next part.

Let’s compare: passwords vs Passkeys?

Let’s address the cryptography in the room – which is safer and why?

Passwords are strings of characters that one needs to remember – this fact alone causes many issues. For one, you might forget them and go through the hassle of retrieving access to the account. While not the end of the world, it is bothersome for the user. On top of that, someone can steal your password or brute force their way into your account – especially if you don’t comply with password creation best practices and opt for an easy-to-remember 123Password#. Passwords can also be phished or social-engineered out of you, sometimes without you even noticing, causing significant damage. Last but not least, they are vulnerable to data leaks, in which emails and passwords fall into the wrong hands.

On the flip side, though, Passkeys circumvent every single issue presented above. You just Face ID your way into the account, with the private/public key matching happening below the surface. You can’t forget anything, you can’t make a typo, and no phishing link can scam you into giving access. It’s both more user-friendly and simply safer.

In a nutshell, then:

Passwords: Vulnerable to phishing, data breaches, and password reuse.

Passkeys: Offer significantly stronger security, an enhanced user experience, and eliminate the need to manage passwords.

Do Passkeys use Bluetooth?

A common question is whether you need Bluetooth to enable Passkeys and, hence, whether your physical proximity matters at all.

This myth may have arisen because Passkeys use Bluetooth Low Energy (BLE), but it’s not for everyday authentication. Rather, it’s used when you want your phone to communicate with your laptop to authenticate your access there. So it wouldn’t be used between the phone and a website, but between the phone and another device that wants to access a website. It’s also called ‘proximity-based authentication’.

Benefits of Passkeys

Let us now go through a more detailed list of the benefits that Passkeys bring, summarizing what we’ve learned so far.

Enhanced Security

• Phishing Resistance: Passkeys rely on device-based authentication, making phishing attempts nearly impossible. Phishing websites cannot capture or steal Passkeys as they are stored securely within the device.
• Reduced Password Reuse Risk: Each Passkey is unique to a specific account, minimizing the impact of a single account compromise.
• Biometric Authentication: Adds an extra layer of security, making impersonation extremely difficult. Biometric methods (fingerprints, facial recognition) provide highly personal, unique identifiers.
• What you have and what you are: Passkeys combine two axes of user verification, namely what you have (your device) and what you are (biometrics).

Improved User Experience

• Simplified Logins: Eliminate the need to remember and manage complex passwords. You also never have to retype your password.
• Faster and More Convenient: Streamline the login process to make it quicker and easier for users.
• Seamless Cross-Platform Experience: Passkeys can be used across various devices (smartphones, tablets, laptops) and operating systems.

If you're planning a new mobile app, our 30 High-Impact Features in Mobile Apps checklist covers the essential features users expect beyond secure sign-in.

Limitations of Passkeys

While we’re presented with a plethora of benefits of Passkeys, are there any disadvantages that we might need to consider? There are indeed some.

First, there is the initial implementation effort. Providers will need to bear the cost of integrating this into their service. While it’s not a downside of Passkeys per se, it is something to take into account. Thankfully, when it comes to admin work and hence cost, it will be more profitable in the long term than passwords, as there will be much less trouble helping people recover credentials or accounts that have been stolen or blocked.

Moreover, there might be some accessibility concerns. We now know that biometrics add a highly personal, unique layer of security that’s very hard for bad actors to work around, while also being very convenient. Some users with disabilities may face challenges with certain biometric authentication methods, though.

Thankfully, these issues can be mitigated.

1. Alternative Authentication Methods:

• Offering alternative authentication methods, such as PINs, patterns, or security keys, is essential for inclusivity.
• Allowing users to choose their preferred authentication method provides flexibility and accommodates diverse needs.

2. Accessibility Features:

• Implementing features like voice commands, screen reader compatibility, and adjustable sensitivity for biometric sensors can improve accessibility for users with disabilities.

3. User-Centered Design:

• Involving users with disabilities in the design and testing process can help identify and address accessibility barriers.

The last popular criticism is device dependency. Since the entire process relies on the private key stored on the user’s phone, issues may arise if that device is lost.

While, in theory, it would lock the user out of their accounts, there are a couple of key points to consider. First, a bad actor cannot take advantage of your phone, as they would still need to unlock the device somehow and then use biometrics to authenticate it, which is not possible. How about you regain access, though?

It’s not a big issue if the service has implemented a proper recovery mechanism. There may be a way for you to receive a so-called "magic link" and regain access to your account.

On top of that, you can store your Passkeys in the cloud or use cross-device sync, which lets you authenticate on a different device (for instance, your MacBook when you’ve lost your iPhone). These so-called roaming passkeys are the industry standard.

All in all, while there are valid concerns, they are mitigable with proper measures.

Passkeys and 2FA

We all know that Two-Factor Authentication (2FA) is crucial to cybersecurity. How does it apply to Passkeys, though?

Passkeys are not typically used alongside 2FA as they are themselves a sort of 2FA (a thing you own [device] and who you are [biometrics]). They might be used as the first step in 2FA for highly secure environments, such as admin access, alongside, say, a password.

Using a password as the first step and a Passkey as the second could work, but it would defeat the purpose of a seamless passwordless experience for everyday use apps. In short, Passkeys and 2FA/multi-factor authentication can co-exist, but mainly in super high-security contexts and with Passkeys as the first step.

When can you use Passkeys?

With a full understanding of how Passkeys work and their benefits, an immediate question arises: When would I want to use Passkeys? If your website or app wants to take advantage of any of the following use cases, Passkeys are a great choice.

1. Seamless Sign in

This is the most common usage. Users simply click a "Sign in with Passkey" button on a website or within an app. The device then prompts the user to authenticate themselves (e.g., with a fingerprint/face ID scan) and automatically completes the login process.

2. Sign in with a different device

If a user switches devices (e.g., from their phone to their laptop or Android to iOS), they can easily sign in to the same account using the Passkey stored on their new device using a QR code. This seamless transition enhances the user experience across multiple devices. If you are within your environment, it will switch between devices automatically, such as within Apple. If you know your users will use your app on multiple devices, Passkeys will help them switch between devices.

3. Seamless Re-authentication

Passkeys can be used for seamless re-authentication purposes, such as when a user attempts to access sensitive information or perform high-risk actions. This adds an extra layer of security by requiring re-verification of the user's identity before granting access. On top of that, it’s super user-friendly and does not disturb the UX by, for instance, redirecting users to a different site.

Industry examples of Passkeys

At the beginning of the piece, we mentioned the big three companies that lead the way in the Passkey sphere - Apple, Microsoft, and Google. Let us present visually how their interfaces look.

How to implement Passkeys

From this point, how do you go about actually implementing Passkeys into your service? There are two main approaches:

1. The first is custom integration. This gives you full control over the implementation but requires building and testing every part of the authentication flow yourself, from the user interface and accessibility to backend integration, platform-specific APIs, and security testing. Also, it may require all the steps that you might expect, ranging from custom UI and accessibility to backend integration to testing and debugging.

2. The second is using an out-of-the-box solution. It can save time and, naturally, money. For example, if you're building a Flutter application, our Flutter Mobile App Template solution already includes production-ready authentication and other core building blocks, helping you integrate features like Passkeys much faster.

Conclusion

Passkeys represent one of the biggest improvements to online authentication in years. They remove many of the weaknesses of traditional passwords while making the login experience faster and more convenient for users.

As support continues to grow across operating systems, browsers, and applications, Passkeys are becoming the new standard for secure authentication. If you're building a modern app, now is the right time to consider adding them to your authentication strategy.