01 What is WebAuthn?
WebAuthn (Web Authentication) is a browser API that allows servers to register and authenticate users using public-key cryptography instead of a password. It is part of the FIDO2 project.
It enables users to log in using authenticators like fingerprints, face scan, USB keys (YubiKey), or mobile devices.
02 What are Passkeys?
Passkeys are a user-friendly implementation of WebAuthn credentials. Unlike traditional hardware-bound keys, Passkeys can be synced across devices (e.g., via iCloud Keychain or Google Password Manager).
This makes them resistant to loss and easy to use, solving the main usability hurdles of early FIDO adoption.
03 How It Works
The process relies on public-key cryptography:
- Registration: The user's device generates a key pair (public and private). The public key is sent to the server, while the private key stays securely on the device.
- Authentication: The server sends a challenge. The device signs the challenge with the private key (after biometric verification). The server verifies the signature with the stored public key.
At no point is a shared secret (like a password) transmitted over the network.
04 Security Benefits
Phishing Resistant
Passkeys are bound to the specific domain (origin). A fake site (e.g., `g0ogle.com`) cannot trick your device into using the passkey for `google.com`.
No Shared Secrets
Since the server doesn't store a password (only a public key), server breaches don't leak credentials that can be reused elsewhere.
Stronger than 2FA
Passkeys inherently provide multi-factor authentication (Possession + Inherence/Biometrics) in a single step.
05 Frequently Asked Questions
Do Passkeys replace passwords entirely?
Ideally, yes. They are designed to be a complete replacement, but many sites support both during the transition period.
What happens if I lose my device?
Passkeys are typically synced across your cloud account (iCloud, Google Password Manager), so you can recover them on a new device. Cross-device authentication is also possible.
Is WebAuthn supported in all browsers?
Yes, WebAuthn is supported by all major modern browsers including Chrome, Firefox, Safari, and Edge.
Does the server see my biometric data?
No. Biometric verification (FaceID, TouchID) happens locally on the device. The server only receives a cryptographic signature, not your fingerprint or face data.