Passkey Security Explained

Technical Introduction

Traditional authentication relies on shared secrets: both the client and the server must know the password (or its hash) to verify identity. Passkeys, built on the FIDO2/WebAuthn standard, abandon this model. Instead, they use public-key cryptography. The user's device holds a private key that never leaves the hardware, while the server holds only a public key.

Problem Framing

Because the server only holds public keys, a server-side breach does not result in the loss of actionable credentials. A database dump of public keys provides an attacker with no ability to log into user accounts. Furthermore, because passkeys are cryptographically bound to the origin domain (e.g., `github.com`), they are inherently phishing-resistant. An attacker hosting a fake site on `githuh.com` cannot trick the passkey into authenticating.

Architectural Explanation

The security of a passkey entirely depends on the security of the private key. In a cloud-synchronized passkey ecosystem (like Apple iCloud Keychain or Google Password Manager), private keys are encrypted and synced across servers to allow seamless multi-device usage.

In a local-first architecture, the private key is generated and stored locally, typically secured by the device's secure enclave and protected behind biometric authentication.

Real-World Risks

While cloud-synced passkeys are highly convenient, they introduce a meta-authentication vulnerability. If an attacker compromises your primary iCloud or Google account, they potentially gain access to your entire passkey vault.

Device-bound (or locally stored) passkeys eliminate this cloud risk but introduce a severe availability risk. If the physical device is lost or destroyed, the private keys are unrecoverable. Users of local-first passkeys must ensure the services they use support registering multiple passkeys (one for a phone, one for a backup hardware key) or provide secure fallback methods.

Glossary Concepts

• Asymmetric Cryptography: A cryptographic system using pairs of keys: public keys which may be disseminated widely, and private keys which are known only to the owner.
• FIDO2 / WebAuthn: The underlying open standards that allow servers to register and authenticate users using public key cryptography instead of a password.
• Origin Binding: A security mechanism where the cryptographic signature generated during authentication is mathematically tied to the specific domain requesting it, preventing phishing.