How Passkeys Work: A Guide

A passkey is a modern replacement for passwords that is both easier to use and much more secure. Unlike a password, which is a “shared secret” you have to remember and type, a passkey is a digital credential built on Public-Key Cryptography.

Here is a breakdown of how they work, from the technical “handshake” to the daily user experience.

1. The Core Technology: Asymmetric Cryptography

At its heart, every passkey consists of a mathematically linked pair of keys:

• The Private Key: This stays securely on your device (phone, computer, or security key). It is never shared with anyone, not even the website you are logging into.
• The Public Key: This is sent to the website or app when you first “create” the passkey. The website uses this to verify your identity later, but the public key itself cannot be used to log in.

2. The Registration “Ceremony”

When you create a passkey for a website (like Google, Amazon, or a banking app), the following happens:

1. Request: Your device asks the website to register a new credential.
2. Generation: Your device generates a unique public-private key pair specifically for that website.
3. Storage: The private key is saved in your device’s secure hardware (like the Secure Enclave on an iPhone or the TPM on a Windows PC).
4. Exchange: The public key is sent to the website and stored in their database.

3. The Login “Ceremony”

When you return to the site to log in, you don’t type anything. Instead, a “challenge-response” process occurs:

1. Challenge: The website sends a random “challenge” (a string of data) to your browser or app.
2. Verification: Your device asks you to prove it’s you using biometrics (Face ID, Fingerprint) or your device PIN.
3. Signing: Once you verify, your device uses its private key to “sign” the challenge.
4. Verification: The signature is sent back to the website. The website uses its stored public key to verify the signature. Since only your private key could have created that specific signature, the website knows it’s you and grants access.

4. Why Passkeys Are More Secure

Passkeys solve the most common security flaws of the last 30 years:

• Phishing-Resistant: A passkey is “bound” to the website’s domain. If you accidentally visit a fake site (e.g., g00gle.com), your browser will refuse to use the passkey because it doesn't match the original domain.
• No Shared Secrets: With passwords, if a company’s database is hacked, your password is leaked. With passkeys, the company only has your public key, which is useless to a hacker.
• Nothing to Remember: You don’t need to create complex characters or use a password manager to auto-fill. Your device handles the “secret” for you.

5. Synced vs. Device-Bound

There are two main ways passkeys are stored:

• Synced Passkeys: Most people use these. They are backed up to your cloud account (Apple iCloud, Google Password Manager, or 1Password). If you get a new phone, your passkeys move with you automatically.
• Device-Bound Passkeys: These stay on a specific piece of hardware, like a physical YubiKey. They cannot be copied or backed up, which provides the highest level of security for high-risk accounts.

6. Time Sequence

Why this “Handshake” is so secure:

• Steps 2 & 3 (The Challenge): The “Challenge” is unique every single time. Even if a hacker intercepted the communication, they couldn’t reuse that signature for a second login.
• Step 4 (The Domain Check): Your device won’t even prompt you for a fingerprint if the website URL is fake (e.g., bank-login.com instead of bank.com). The "handshake" fails before it even begins.
• Step 6 (The Signature): The website never sees your biometric data or your Private Key. It only sees the “math” that proves you have them.