Auth Standards Deep Dive · 6 of 6

Passkeys & WebAuthn — Phishing-Resistant Login

Passkeys are the modern, consumer-friendly delivery of FIDO2 / WebAuthn — public-key credentials bound to a website's origin, unlocked by a fingerprint, face, or PIN, and synced across the user's devices via the OS. They eliminate the password, defeat phishing by construction, and ship in every modern browser and operating system. In 2026, they're the default direction for new login flows.

WebAuthnFIDO2PasswordlessPhishing-ResistantSynced Credentials
← Back to Security
Quick Facts

What a Passkey Is

Basic Concepts

  • Public-key cryptography: on registration, the device generates a new key pair. Public key goes to your server; private key stays on the device.
  • Bound to origin: the credential is tied to your domain. The browser refuses to use it for any other origin — phishing sites can't trigger a signing.
  • Unlocked locally: the user proves possession with a biometric or device PIN. The biometric never leaves the device.
  • Synced or device-bound: "synced passkeys" (the consumer default) follow the user across devices via iCloud Keychain, Google Password Manager, 1Password, etc. "Device-bound" credentials live on a hardware key only — what enterprises often require.
  • Built on WebAuthn, a W3C standard with FIDO2 underneath. Native API in every modern browser; first-class support in iOS, macOS, Android, Windows.
Why It Wins

What Passkeys Buy You

Phishing-Resistant by Design

Conventional MFA can be relayed — the attacker proxies a fake login site, captures the OTP, and uses it in real time. Passkeys can't be: the credential is bound to the legitimate origin's domain, and the device's WebAuthn API simply refuses to sign for the wrong domain. The attacker never gets a usable signature, no matter what the user types or taps.

No Shared Secrets to Steal

Your server stores public keys. A database dump leaks public keys — useless to an attacker. Compare to passwords (hashable but crackable) or TOTP secrets (immediately usable if leaked).

Real UX Win

"Tap your fingerprint to sign in" beats "find your authenticator app, type 6 digits within 30 seconds." Passkey sign-ins routinely measure 2–4× higher completion than password+OTP.

Multi-Device via OS Sync

Synced passkeys let a user sign in on their iPhone, then their MacBook, then a new device — without re-enrolling. Apple, Google, Microsoft, 1Password, Dashlane, Bitwarden, and others all sync. The early "you'll get locked out if you lose your phone" objection is mostly gone.

The Flow

Registration and Sign-In

Registration
  1. User signs in with their existing method (password, magic link, OIDC).
  2. Server generates a random challenge and sends WebAuthn registration options including the relying party (your domain), user info, and supported algorithms.
  3. Browser prompts the user to use Touch ID / Face ID / a security key.
  4. Device generates a key pair, signs the challenge, returns the public key + attestation to the browser.
  5. Server verifies the attestation, stores the public key keyed by user.
Sign-In
  1. User clicks "sign in." Server sends a challenge.
  2. Browser presents available passkeys; user picks one and unlocks the device.
  3. Device signs the challenge with the private key.
  4. Browser sends the signed assertion back; server verifies against the stored public key.
  5. Issue a session.
Discoverable Credentials

The smoothest UX: the server requests a credential without naming a user. The browser shows the user every passkey they have for your origin; they pick one. The user identifier comes back with the assertion. No email field at all — sign-in is one click.

Building It

What's Needed in Practice

Account Recovery Plan

Synced passkeys cover most of the "lost device" cases. You still need a recovery path for users who lose access to their entire OS account or sync chain. Options: registered backup passkey on a hardware key, identity verification, recovery via another factor. Don't downgrade to email-only — that's how account takeovers come back.

Multiple Credentials Per User

Let users register more than one passkey — phone + laptop + hardware key. Show them a management UI listing each credential with the device name and last-used time, and let them revoke individually.

Fallbacks and Coexistence

Don't go passkey-only on day one. Most teams ship passkeys alongside passwords; over time, the password becomes the fallback and eventually optional. Track adoption and breach signals before removing passwords entirely.

Attestation — Mostly Skip It

WebAuthn lets you require attestation about which authenticator was used. For consumer apps, set attestation: "none" — strict attestation breaks legitimate platform authenticators in subtle ways and gives little real value. Attestation matters mainly for enterprise contexts that require certified hardware keys.

Use a Library or Provider

WebAuthn is a serious protocol with subtle verification rules. Libraries: SimpleWebAuthn, py_webauthn, Webauthn4j, Yubico's webauthn-server-core. Or a managed service: Auth0, Okta, Stytch, Clerk, Hanko, Corbado, Passage. Don't reinvent.

Decision

When to Ship Passkeys

  • New consumer app: support passkeys on day one. Add password as a fallback only if you must.
  • Existing app with millions of users: add passkeys as an option; promote them on the account settings page; track adoption; phase out SMS over time.
  • Enterprise/admin SSO: require WebAuthn (hardware key or platform authenticator) for privileged access. Skip the password entirely if your IdP supports it.
  • Mobile-only app: passkeys integrate with native iOS/Android keychains; the experience is smoother than email codes.

Passkeys are the first credential model in 30 years that's both more secure and more pleasant. The reasons to delay are mostly inertia.

Continue

Other Auth Standards

← OAuth 2.0 ← OpenID Connect ← SAML ← JWT ← MFA / 2FA ↑ Back to Security