Passkeys replace passwords. Biometrics on the device, cryptographic key in the secure enclave. Phishing-resistant, user-friendly.
How passkeys work¶
- Registration: the device creates a key pair, public key goes to the server
- Login: the server sends a challenge, the device signs with the private key
- Biometrics (Face ID, Touch ID) unlocks the private key
- The private key never leaves the device
WebAuthn registration¶
// Frontend const credential = await navigator.credentials.create({ publicKey: { challenge: serverChallenge, rp: { name: “MyApp”, id: “myapp.com” }, user: { id: userId, name: “[email protected]”, displayName: “Jan” }, pubKeyCredParams: [{ alg: -7, type: “public-key” }], authenticatorSelection: { residentKey: “required” }, } }); // Send credential to server for storage
Advantages of passkeys¶
- Phishing-resistant (bound to origin)
- No passwords to forget
- Biometric verification
- Cross-device sync (iCloud, Google Password Manager)
Key Takeaway¶
Passkeys are the future of authentication. Phishing-resistant, user-friendly. Implement as the primary method.
securityfido2passkeyswebauthn