Passkeys And FIDO2 Basics
A passkey is a login credential created using public-key cryptography. Instead of sending a password to a website, your device proves possession of a private key while the server verifies a matching public key. The result is a sign-in flow that does not require the site to receive a reusable secret from you.
FIDO2 is the set of standards that define how these credentials are created and used. FIDO2 includes two main parts: the WebAuthn protocol for browsers and the CTAP protocol for authenticators like security keys. When you see “passkey” in a password manager or operating system prompt, it usually means a WebAuthn credential is being created and stored in an authenticator.
Practical example: you sign in to an account on a laptop. The site sends a challenge to the browser, the browser asks your authenticator (phone, laptop, or a security key) to sign that challenge, and the server checks the signature. If you later sign in on another device, the account can offer a synced passkey or a recovery path, depending on how the account and your devices are configured.
One detail that matters: passkeys are tied to an origin (the domain) and an authenticator policy. That binding reduces credential reuse across sites, which is a major weakness of passwords.
Common Pain Points And Misbeliefs
People often treat passkeys as “just a password manager feature,” then get surprised when recovery behaves differently than password resets. A password reset typically relies on email or SMS verification. Passkey recovery often relies on device sync, account recovery codes, or a separate recovery authenticator, and the exact path varies by provider.
Another misbelief is that passkeys remove all account risk. They reduce phishing risk because the authenticator signs a challenge intended for a specific origin, and many phishing attempts cannot produce a valid signature for a different domain. Still, attackers can target account takeover through other channels like session hijacking, malware on the signing device, or social engineering that changes your recovery options.
Dependencies also get overlooked. Passkeys require browser support for WebAuthn and an authenticator that supports the needed algorithms. If a site only supports older sign-in methods, you may still need passwords or other factors. I’ve seen this in practice with older embedded webviews; the login page loads, but the WebAuthn prompt never appears, which is frustrating when you expected a passkey prompt.
Finally, people confuse “FIDO2” with “FIDO U2F.” FIDO U2F is older hardware-token behavior; FIDO2/WebAuthn is the modern web standard. Some devices support one and not the other, so compatibility can vary by browser version and platform.
How To Choose And Use Passkeys
Start With Your Account Settings
Check whether your important accounts offer passkeys and what recovery options exist. Look for settings like “Passkeys,” “Security keys,” or “Two-step verification.” If the account offers both passkeys and security keys, add at least two authenticators so you can sign in if one device is lost.
When you add a passkey, note which device created it. On iOS and macOS, for example, passkeys may be synced through iCloud Keychain when enabled; on Android, they may sync through Google Password Manager depending on settings. If you disable sync later, you can strand passkeys on a single device.
For a quick sanity check, try signing out and signing back in on a second device. If the account offers a passkey prompt there, your setup is likely consistent. If it falls back to passwords, you may need to add a second passkey or a recovery method.
Use Security Keys For Higher Control
Security keys are dedicated authenticators that support FIDO2/WebAuthn. They reduce reliance on a phone’s sync state and can be more predictable during device changes. A common approach is to keep one key at home and carry another, then store a backup in a safe place.
Choose keys that support the WebAuthn standard and the algorithms your browser uses. Most modern keys support multiple transports like USB, NFC, or Bluetooth, but the exact behavior depends on the key model and your device. I once tested a USB-only key on a tablet with no USB-C adapter; it worked on the laptop but not in that setup, which is the kind of mismatch that causes avoidable lockouts.
For outcomes, the practical goal is not “perfect security,” but fewer single points of failure. With two keys, you reduce the chance that one lost device blocks access.
Plan Recovery Before You Remove Passwords
Passwords still matter during the transition. Many services let you add passkeys while keeping password login enabled. Keep the password for a while, then remove it only after you confirm passkey recovery works on your devices.
Recovery often hinges on account-level controls like backup codes, recovery email, and the ability to add another authenticator. If a site offers backup codes, store them offline. If it offers “add another passkey,” do that while you still have access.
Realistic expectation: you may need 10–30 minutes to set up a second authenticator and verify sign-in on a different device. That time cost is usually smaller than the time spent trying to regain access after a lockout.
Understand What “Phishing-Resistant” Means
Passkeys are designed to resist phishing because the authenticator signs a challenge for a specific origin. A phishing site can ask for credentials, but it cannot trick the authenticator into signing for the attacker’s domain without the correct origin binding.
That protection does not cover every attack. If malware steals your session cookies or captures your device while you approve prompts, the attacker may still gain access. If an attacker changes your recovery email or adds their own passkey, passkeys do not stop that.
So treat passkeys as a reduction in one class of risk. Pair them with device security, strong account recovery hygiene, and careful review of login alerts.
Case Examples With Realistic Outcomes
Example 1: Phone Loss With Sync Enabled
Sam enables passkey sync through a password manager and adds a passkey to a banking account. Sam later loses the phone and restores the new phone from the same account. The banking site offers a passkey prompt on the new phone, and Sam signs in without using the password. The recovery email remains unchanged, and Sam verifies the account’s “trusted devices” list after login.
The lesson: sync can work well, but you still need to verify recovery settings. If Sam had disabled sync or changed the recovery email, the outcome could differ.
Example 2: New Laptop Without a Second Authenticator
Priya adds passkeys to a shopping account using only her desktop browser. Later she buys a new laptop and logs in with the old password, then tries to add a passkey. The site allows passkey creation, but her old desktop is offline and she cannot complete the verification step that requires an existing authenticator. She uses backup codes stored from the original setup and then adds a new passkey on the new laptop.
The lesson: passkeys reduce phishing risk, but recovery flows still depend on what you set up earlier. Backup codes and a second authenticator prevent a “new device, no path forward” situation.
Passkeys Vs Passwords Checklist
| Criterion | Passkeys (FIDO2/WebAuthn) | Passwords | What To Check |
|---|---|---|---|
| Phishing resistance | Designed to block many phishing attempts via origin-bound signatures | Reusable secret can be captured and reused on attacker sites | Whether the site supports WebAuthn passkeys and how it handles origin binding |
| Recovery | Depends on sync, backup codes, and additional authenticators | Often depends on email/SMS reset and account verification | Backup codes and ability to add a second authenticator while logged in |
| Device dependence | Tied to authenticator availability and browser support | Works anywhere the password is entered | Browser and platform support; test sign-in on a second device |
| Attack surface | Reduced credential theft; still vulnerable to session theft and account recovery changes | Credential theft and reuse are common failure modes | Device security, login alerts, and recovery settings |
Decision checklist: add a passkey to at least one high-value account, create a second authenticator, store backup codes if offered, test sign-in on another device, then keep password login until recovery is proven. If a site lacks passkey support, use a password manager and unique passwords instead of reusing old ones.
Common Mistakes That Cause Lockouts
One frequent mistake is removing passwords too early. If you delete the password before you confirm passkey recovery, you may face a long support process if your authenticator is unavailable.
Another mistake is relying on a single device without understanding sync. Sync can fail after account changes, OS resets, or disabled keychain settings. I’ve seen people enable passkeys on a phone, then later wipe the phone and discover the passkey never synced to the new setup.
People also skip browser and platform checks. WebAuthn support varies by browser version and environment, including embedded browsers inside apps. If a login happens inside an app webview, the passkey prompt may not appear even though it works in the desktop browser.
Finally, users sometimes store recovery codes in the same place as the device they lose. If both are stolen, recovery becomes harder. Offline storage matters more than it sounds.
FAQ
Are Passkeys The Same As Security Keys?
Passkeys are credentials created via FIDO2/WebAuthn. Security keys are one type of authenticator that can store and use those credentials, while phones and laptops can also act as authenticators.
Do Passkeys Work Without Internet?
Passkey creation and sign-in require a server challenge from the website, so the login flow needs network access. The authenticator can store keys offline, but the site still must verify the signature.
Can I Use Passkeys Across Different Browsers?
Often yes, because WebAuthn is standardized, but support depends on browser and platform versions. Testing on the specific browser you use for critical accounts reduces surprises.
What Happens If I Lose My Phone?
If sync is enabled and the new phone is set up under the same account, you may regain access. If sync is off or recovery options are limited, you may need backup codes or a second authenticator.
Do Passkeys Eliminate Passwords Completely?
Not automatically. Many services still require passwords for some flows, and some accounts may not support passkeys. A practical approach keeps passwords until recovery is verified.
Author's Insight
Passkeys shift authentication from “shared secret entry” to “cryptographic proof of possession” using FIDO2/WebAuthn. That design reduces phishing success rates because the signature is bound to the site origin, but it does not stop attacks that target sessions, malware, or account recovery changes.
Most real-world failures come from recovery planning gaps: users add a passkey on one device, then discover they cannot recreate it elsewhere. A careful setup uses at least two authenticators and stores backup codes when offered.
Browser support also matters. For example, WebAuthn behavior can differ across Chrome, Safari, and Firefox versions, and embedded app browsers may lag behind desktop browsers.
If you want a low-friction transition, keep password login enabled until you complete a sign-in test on a second device and confirm the account’s recovery path works.
Key Takeaways
Passkeys are FIDO2/WebAuthn credentials that prove identity with origin-bound cryptographic signatures instead of sending passwords.
Phishing resistance improves, but account takeover risks still exist through session theft, malware, and recovery-option changes.
Recovery planning determines whether passkeys feel smooth or painful: add a second authenticator, store backup codes, and test sign-in on another device.
Keep passwords enabled during the transition until you confirm the recovery path works for your devices and browsers.
