Skip to main content

Passkeys

Status: Final

Passkeys are discoverable FIDO2 credentials that sync across a user's devices through platform authenticators. They are the consumer and enterprise replacement for passwords — phishing-resistant, no shared secret, no server-side password hash.

What a Passkey Is​

A passkey is a FIDO2 discoverable credential stored in a platform authenticator's sync fabric:

PlatformStorageSync Mechanism
AppleiCloud KeychainiCloud sync (E2EE)
GoogleGoogle Password ManagerGoogle account sync
MicrosoftWindows Hello / Microsoft accountMicrosoft cloud
Cross-platformThird-party managers (1Password, Bitwarden)Vendor cloud

The private key never leaves the secure enclave; only the synced credential handle travels through the cloud.

Security Model vs Passwords​

PropertyPasswordPasskey
PhishableYesNo (origin-bound)
Reusable across sitesYes (credential stuffing)No (separate key per site)
Server-side breach impactPassword hash leakedOnly public key leaked (useless)
Requires remember/rotateYesNo
RecoverableOnly if you know itFrom cloud backup

Enterprise Passkeys​

Microsoft Entra ID supports device-bound passkeys (hardware-based, non-syncable) as a phishing-resistant MFA method for high-assurance scenarios. This is distinct from syncable passkeys — enterprise policy can enforce non-syncable hardware-backed credentials.

Attack Considerations​

AttackPasskey Resistance
Real-time phishing proxy (AiTM)Resistant — signed response is origin-bound
Malware on enrolled deviceVulnerable if malware can invoke the platform authenticator in the user's session
iCloud / Google account compromiseSyncable passkeys can be accessed if sync account is compromised
Social engineering key recoveryVulnerable to account recovery flows if recovery is weak
TopicLink
FIDO2 / WebAuthnfido2-webauthn
Smart Cardssmart-cards
MFA Technologiesmfa-technologies