Passkey

A passkey is a FIDO2 credential, meaning W3C Web Authentication (WebAuthn) between the relying party and the browser plus the FIDO Alliance's Client to Authenticator Protocol (CTAP 2) between the browser and an external authenticator. Technically it is a discoverable credential, formerly called a resident key: the authenticator stores the private key together with the RP ID and a user handle, so sign-in can begin without a user name, typically through autofill-style conditional mediation. WebAuthn Level 2 became a W3C Recommendation in April 2021, and Level 3 followed on 25 August 2026.

At registration the site calls navigator.credentials.create() with a random challenge, its RP ID (a registrable domain such as example.dk), a user ID and acceptable algorithms as COSE identifiers, usually -7 (ES256) and -257 (RS256), and requests residentKey "required" plus a user-verification preference. The authenticator generates a fresh key pair scoped to that RP ID and returns authenticator data containing the SHA-256 hash of the RP ID, a flags byte, a signature counter, the credential ID and the public key, optionally with an attestation statement. At sign-in, navigator.credentials.get() asks the authenticator to sign the authenticator data concatenated with the hash of clientDataJSON, which the browser fills with the type, the challenge and the actual origin. The server verifies the signature with the stored public key and checks challenge, origin, RP ID hash and the UP (user present) and UV (user verified) flags.

Phishing resistance comes from that binding: the browser, not the user, asserts the origin, and the authenticator will not even offer a credential whose RP ID does not match the site, so a look-alike domain gets nothing to relay. This is verifier-name binding in the sense of NIST SP 800-63B-4 §3.2.5. Server-side, only public keys are stored, so a database breach yields nothing usable for login.

Passkeys are either synced or device-bound. After the joint commitment by Apple, Google and Microsoft in May 2022, platforms began syncing passkeys through iCloud Keychain, Google Password Manager and third-party password managers; the BE (backup eligible) and BS (backup state) flags reveal this, and synced authenticators often report a signature counter of zero, which makes counter-based clone detection meaningless. SP 800-63B-4 accepts syncable authenticators up to AAL2 but not at AAL3, which requires a non-exportable key, so administrator and high-assurance use calls for device-bound passkeys on security keys or platform TPMs, often with attestation to verify the model. Cross-device sign-in uses the hybrid transport, a QR code plus a Bluetooth proximity check, so a phone can authenticate a laptop. The residual risks are the weakest remaining recovery or fallback method (SMS or password left enabled), compromise of the sync account, and theft of the session cookie issued after a perfectly phishing-resistant login.