[Atomic Glue](atomicglue.co)
SECURITY
Home › Glossary › Security· 305 ·

Passkeys / WebAuthn

pass-keys / web-auth-nnoun
Filed underSecurityWeb Development
In brief · quick answer

Passkeys are a passwordless authentication standard using public-key cryptography. WebAuthn is the W3C API that enables passkeys. Users authenticate with biometrics, PIN, or device unlock rather than passwords.

§ 1 Definition

Passkeys are a FIDO2 standard that replaces passwords with cryptographic key pairs. When a user registers, their device generates a public-private key pair. The private key never leaves the device and is protected by the device's own authentication (biometrics, PIN). The public key is stored by the web service. To authenticate, the device proves possession of the private key via a cryptographic challenge-response. WebAuthn (Web Authentication) is the W3C standardized JavaScript API that enables passkeys in browsers. Passkeys sync across a user's devices via their platform provider (iCloud Keychain, Google Password Manager) using end-to-end encryption.

§ 2 How Passkeys Work

During registration, the server sends a challenge to the browser. The browser calls navigator.credentials.create(), prompting the user with their device's authentication (Face ID, Touch ID, Windows Hello, or device PIN). The device generates a key pair and returns the public key to the server. During login, the server sends a challenge. The browser calls navigator.credentials.get(), the user authenticates to their device, and the device signs the challenge with the private key. The server verifies the signature using the stored public key. No password is ever transmitted or stored server-side.

§ 3 Syncing and Portability

Platform providers (Apple, Google, Microsoft) sync passkeys across user devices using end-to-end encrypted cloud sync. A passkey created on an iPhone is available on a Mac, iPad, or other Apple devices. Google passkeys sync across Android and Chrome on desktop. This solves the historical problem of platform-bound hardware keys being tied to a single device. Passkeys can also be used cross-platform via QR codes (a phone can authenticate on a nearby desktop).

§ 4 Why Passkeys Matter

Passkeys are resistant to phishing, credential stuffing, and data breaches. Since the private key never leaves the device and is never sent to the server, there is nothing for an attacker to steal. Servers only store public keys, which are useless for authentication. Apple, Google, and Microsoft have all deployed passkey support, and password managers (1Password, Bitwarden, Dashlane) support storing passkeys. Passkeys represent a genuine path toward a passwordless future.

§ 5 Note

Passkeys require platform support. As of 2024, they work on iOS 16+, macOS Ventura+, Android 9+, Windows 10+ (via Microsoft Account), and in Chrome, Safari, Edge, and Firefox. Not all sites support them yet, but adoption is growing rapidly.

§ 6 Common questions

Q. Are passkeys more secure than passwords plus MFA?
A. Yes. Passkeys are inherently phishing-resistant because the browser validates the origin before allowing authentication. An attacker cannot trick a user into authenticating on a fake site because the challenge is bound to the legitimate origin.
Q. What happens if I lose all my devices?
A. Platform providers handle recovery through their account recovery processes (e.g., Apple ID recovery, Google account recovery). You can also register multiple passkeys across devices as a backup strategy.
Q. Can passkeys be used without biometrics?
A. Yes. Passkeys can be unlocked with a device PIN or pattern. Biometrics are more convenient but not required.
Key takeaways
  • Passkeys use public-key cryptography for passwordless authentication.
  • WebAuthn is the browser API that enables passkeys (W3C standard).
  • Private keys never leave the device. Servers store only public keys.
  • Passkeys are phishing-resistant and supported by Apple, Google, and Microsoft.
How Atomic Glue helps

Atomic Glue integrates WebAuthn passkey authentication into web applications, supporting both platform and cross-device authentication flows. We help clients adopt passwordless architectures. Get in touch.

Get in touch
Written by Atomic Glue Security Team, Atomic Glue · Last updated December 2024
# Passkeys / WebAuthn

Passkeys are a passwordless authentication standard using public-key cryptography. WebAuthn is the W3C API that enables passkeys. Users authenticate with biometrics, PIN, or device unlock rather than passwords.

Category: Security (also: Web Development)

Author: Atomic Glue Security Team

## Definition

Passkeys are a FIDO2 standard that replaces passwords with cryptographic key pairs. When a user registers, their device generates a public-private key pair. The private key never leaves the device and is protected by the device's own authentication (biometrics, PIN). The public key is stored by the web service. To authenticate, the device proves possession of the private key via a cryptographic challenge-response. WebAuthn (Web Authentication) is the W3C standardized JavaScript API that enables passkeys in browsers. Passkeys sync across a user's devices via their platform provider (iCloud Keychain, Google Password Manager) using end-to-end encryption.

## How Passkeys Work

During registration, the server sends a challenge to the browser. The browser calls navigator.credentials.create(), prompting the user with their device's authentication (Face ID, Touch ID, Windows Hello, or device PIN). The device generates a key pair and returns the public key to the server. During login, the server sends a challenge. The browser calls navigator.credentials.get(), the user authenticates to their device, and the device signs the challenge with the private key. The server verifies the signature using the stored public key. No password is ever transmitted or stored server-side.

## Syncing and Portability

Platform providers (Apple, Google, Microsoft) sync passkeys across user devices using end-to-end encrypted cloud sync. A passkey created on an iPhone is available on a Mac, iPad, or other Apple devices. Google passkeys sync across Android and Chrome on desktop. This solves the historical problem of platform-bound hardware keys being tied to a single device. Passkeys can also be used cross-platform via QR codes (a phone can authenticate on a nearby desktop).

## Why Passkeys Matter

Passkeys are resistant to phishing, credential stuffing, and data breaches. Since the private key never leaves the device and is never sent to the server, there is nothing for an attacker to steal. Servers only store public keys, which are useless for authentication. Apple, Google, and Microsoft have all deployed passkey support, and password managers (1Password, Bitwarden, Dashlane) support storing passkeys. Passkeys represent a genuine path toward a passwordless future.

## Note

Passkeys require platform support. As of 2024, they work on iOS 16+, macOS Ventura+, Android 9+, Windows 10+ (via Microsoft Account), and in Chrome, Safari, Edge, and Firefox. Not all sites support them yet, but adoption is growing rapidly.

## Common questions

Q: Are passkeys more secure than passwords plus MFA?

A: Yes. Passkeys are inherently phishing-resistant because the browser validates the origin before allowing authentication. An attacker cannot trick a user into authenticating on a fake site because the challenge is bound to the legitimate origin.

Q: What happens if I lose all my devices?

A: Platform providers handle recovery through their account recovery processes (e.g., Apple ID recovery, Google account recovery). You can also register multiple passkeys across devices as a backup strategy.

Q: Can passkeys be used without biometrics?

A: Yes. Passkeys can be unlocked with a device PIN or pattern. Biometrics are more convenient but not required.

## Key takeaways

## Related entries

Last updated December 2024. Permalink: atomicglue.co/glossary/passkeys-webauthn

Schedule a call

30 min · Video call

1
Date
2
Time
3
Details