A passkey is a sign-in credential that replaces a password with a public/private key pair. The private key stays on the user's device or in their password manager (iCloud Keychain, Google Password Manager, Microsoft, 1Password, Bitwarden and others) and is unlocked with Face ID, a fingerprint or the device PIN. Your server stores only the public key, so there is nothing worth stealing and nothing a phishing page can capture.
Passkeys vs passwords vs one-time codes
| Password | Password + SMS/app code | Passkey | |
|---|---|---|---|
| Phishing-resistant | No | No: codes can be relayed in real time | Yes: bound to your domain |
| Database breach exposes login | Hashes can be cracked | Partly | No: only public keys stored |
| Reuse across sites | Common | Common | Impossible |
| User effort | Type and remember | Type plus wait for code | One biometric tap |
| Running cost | Reset emails, support | SMS fees | None per sign-in |
How passkeys work, in one paragraph
At registration the browser asks the user's authenticator to create a key pair for your domain (the relying party ID) and sends you the public key. At sign-in your server sends a random challenge. The authenticator signs it with the private key after the user unlocks it, and your server checks the signature with the stored public key. Because the key is tied to your exact domain, a look-alike phishing site cannot request it. This is the WebAuthn / FIDO2 standard every major browser implements.
The rollout plan
- Add passkeys alongside existing sign-in. Do not remove passwords on day one.
- Offer creation after a successful login ("Sign in faster next time with Face ID?"). Conversion is far higher than on a cold settings page.
- Enable autofill sign-in (conditional UI): add
autocomplete="username webauthn"to the username field so saved passkeys appear in the browser's autofill list. - Allow several passkeys per account and show where each was created, so users can add a second device and remove a lost one.
- Design account recovery before launch. Recovery is where attackers go once the front door is strong. Use a verified email plus a second factor, or support-assisted recovery with identity checks. Never a single SMS.
- Measure passkey adoption, sign-in success rate and recovery requests. Only then consider making passkeys the default for new accounts.
Libraries that do the hard part
- Node.js: SimpleWebAuthn (server and browser packages).
- .NET: the Fido2 .NET library (
Fido2NetLib), or the passkey support being added to ASP.NET Core Identity. - Python:
py_webauthn. - Hosted: most identity platforms (Auth0, Clerk, Microsoft Entra, AWS Cognito, Firebase via extensions) now offer passkeys as a setting.
Never write the signature-verification code yourself. Use a maintained library and keep it updated. That is supply-chain hygiene from the OWASP Top 10:2025.
What it costs
On a hosted identity platform, passkeys are usually a configuration change plus UI work: a few days. On a custom auth stack, budget roughly 1–3 weeks of engineering for registration, sign-in, conditional UI, device management, recovery and tests. There are no per-authentication fees, and support costs for password resets go down.
Passkeys don't fix everything
Passkeys secure the sign-in step. Session cookies still need Secure; HttpOnly; SameSite, your site still needs HTTPS with HSTS, and your APIs still need server-side authorization on every request. Check the browser-facing parts with our free website security audit.
ZetsApp adds passkeys and modern authentication to existing products as part of our web app development work. Ask for an estimate.
Frequently asked questions
Are passkeys more secure than passwords?
Yes. Passkeys cannot be phished, reused or leaked from a server breach, because the private key never leaves the user's authenticator and only works on the domain it was created for.
What happens if a user loses their phone?
Synced passkeys are restored from the user's password manager or platform account on a new device. For device-bound passkeys, users need a second registered passkey or your account-recovery process, so design recovery before launch.
Do passkeys work on all browsers?
All current major browsers and operating systems support passkeys through WebAuthn, including Chrome, Safari, Edge and Firefox on desktop and mobile.
Can I use passkeys and passwords together?
Yes, and you should at first. Offer passkeys as an option, encourage adoption after login, and keep passwords or another fallback until most active users have a passkey.
