Passkey

A passkey is a passwordless login credential built on the FIDO2/WebAuthn standards. Instead of a secret the user memorizes and types, a passkey is a cryptographic key pair: the public key is stored by the website or identity provider, and the private key stays on the user's device, unlocked locally with a fingerprint, face scan, or PIN. The FIDO Alliance estimated five billion passkeys in use worldwide as of World Passkey Day 2026, with 68% of surveyed organizations deploying them for employee sign-in.

How it works

When a user registers a passkey, their device generates a unique key pair bound to the exact web origin — say, login.example.com. At sign-in, the site sends a random challenge, the device signs it with the private key after a local biometric or PIN check, and the site verifies the signature with the stored public key. The private key never leaves the device (or its encrypted keychain sync), and the browser will only offer the passkey to the domain it was created for.

That origin binding is what makes passkeys phishing-resistant rather than merely phishing-harder. A lookalike domain gets nothing: there is no password to type into a fake form, no one-time code for an adversary-in-the-middle proxy to relay, and no push prompt to approve during an MFA fatigue attack. Passkeys come in two forms — synced passkeys, which follow the user across devices through a platform or password-manager keychain, and device-bound credentials such as hardware security keys, which cannot be copied off the device and are preferred for administrator and finance accounts.

How to defend with it

Passkeys are a defense, but deploying them well is its own discipline. Attackers respond by targeting whatever phishable paths remain: password fallbacks, legacy protocols, account recovery flows, and help desk resets that will enroll a new factor for a convincing caller — the standard MFA bypass routes. An effective rollout prioritizes high-privilege accounts, restricts fallback methods by policy, and hardens enrollment and recovery in the same project. Our enterprise passkey migration guide covers the sequencing in depth, and phishing simulations verify that the phishable paths are actually closed rather than assumed to be.