How Passkey Sign-In Works, and Why It Replaces Passwords

Passwords have been the standard way to sign in online for decades, despite being easy to forget, reuse and steal. Passkeys offer a different approach that removes the need to type a secret at all. This explainer covers what happens behind the scenes when you use one, and what it changes for both people and websites.

What a passkey is

A passkey is a digital credential that lets you sign in to a website or app using your device, typically confirmed with a fingerprint, face scan or device PIN. It is based on open standards developed by the FIDO Alliance and the World Wide Web Consortium, known as FIDO2 and WebAuthn, and is supported by the major operating systems and browsers.

Unlike a password, a passkey is not something you remember or type. It is created and stored by your device or password manager, and it only works with the specific site or app it was created for.

The technology underneath

Passkeys rely on public key cryptography, which uses a pair of linked keys. When you create a passkey for a site, your device generates both. The public key is sent to the website and stored with your account. The private key stays on your device, or in your password manager's encrypted storage, and is never shared with the site.

The two keys are mathematically connected, so something signed with the private key can be verified using the public key. Crucially, the public key cannot be used to work out the private one.

What happens when you sign in

When you sign in with a passkey, the process typically runs as follows:

• You visit the site and choose to sign in, or your browser offers the passkey automatically.

• The website sends a unique, one-time challenge to your device.

• Your device asks you to confirm it is you, using a fingerprint, face scan or PIN.

• Once confirmed, the device uses the private key to sign the challenge.

• The signed response is sent back to the website.

• The website checks the signature against the public key it holds and lets you in.

Your fingerprint or face data is used only locally to unlock the passkey. It is not sent to the website.

Why passkeys are more secure

Because the private key never leaves your control, there is no password on the website's servers for attackers to steal. If a site suffers a data breach, the public keys exposed are of no use for signing in elsewhere.

Passkeys are also resistant to phishing. Each passkey is tied to the genuine website's address, so a fake site that looks identical cannot trigger it. This removes one of the most common ways accounts are taken over. Passkeys also eliminate the risk of reusing the same password across many sites, since each one is unique.

What changes for people

For most users, passkeys make signing in quicker. There is nothing to type or remember, and the confirmation step is the same one used to unlock a phone or laptop.

Passkeys can be synced across devices through a platform account or password manager, so a passkey created on a phone can also work on a tablet or computer linked to the same account. It is also possible to sign in on a nearby device that does not hold the passkey, usually by scanning a QR code with your phone. Keeping your device and account recovery options secure becomes more important, as they now protect your sign-in credentials.

What changes for websites and apps

For organisations, adopting passkeys means updating sign-in systems to support WebAuthn and deciding how to handle the transition. Most services currently offer passkeys alongside passwords rather than replacing them outright, since not every user or device is ready.

Sites also need clear account recovery processes for people who lose access to their devices, and straightforward guidance on creating and managing passkeys. Done well, passkeys can reduce password reset requests and the support work that comes with them.

The bottom line

Passkeys replace a shared secret with a cryptographic key pair, so there is nothing for attackers to steal from a server or trick a user into typing. Signing in becomes a quick confirmation on a trusted device. The shift will take time, and passwords will remain in use for a while, but passkeys offer a simpler and safer way to sign in for both people and the services they rely on.