Passkey
passkeys · FIDO2 · WebAuthn · security key · passwordless · passwordless authentication · clé d’accès
A password-free sign-in credential based on a pair of cryptographic keys: the private key stays on your device and is unlocked with your fingerprint, face or PIN.
In practice
Passkeys build on the FIDO Alliance’s FIDO2 standards and the W3C’s WebAuthn. At registration, the device creates a key pair unique to each site; the site keeps only the public key, which is useless to a thief. The sign-in proof is bound to the site’s domain name: a fraudulent copy cannot reuse it, which makes passkeys phishing-resistant. A passkey can be synced across your devices by a provider (Apple, Google, Microsoft, a password manager) or kept on a physical key for the most sensitive accounts.
Fictional case: an accounting firm receives a fake “Cumulus Drive” email leading to a perfect copy of the login page. Staff using passkeys simply cannot sign in there: the browser does not offer the key on a domain that is not the right one.
How to protect yourself
- Roll out passkeys first for email and administrator accounts.
- Register at least two authenticators per person to avoid lock-outs.
- Make account recovery as strong as the sign-in itself.
