Unverified60% confidenceFactExact time
When logging in with Passkeys, the server sends a random challenge, the device signs it with the private key and returns the result, and the server verifies the signature with the public key; since the private key is never transmitted, identity cannot be forged even if the server database is stolen.
2
Sources
60%
Confidence
Long-term
Relevance
7/16/2026
First Seen
Sources
Related Claims
Unverified由于 Passkey 私钥从不传输，即便服务端数据库泄露也无法还原凭据，挑战-响应机制从根本上消除了钓鱼攻击的可能性79% similarUnverifiedPasskeys' private keys are stored in the user device's trusted execution environment (TEE) or hardware security module (HSM), and the server only stores the public key.79% similarUnverifiedIf signature verification is bypassed, the private key is leaked, or the update server and download channel are hijacked, an attacker can push arbitrary code to users' machines.75% similarUnverifiedIn PassBolt, each user has an independent key pair, and data cannot be recovered if the private key is lost.74% similarUnverified由于服务器不记录调用方身份的历史状态，单凭一串API Key字符串就足以代表完整的身份权限，Key一旦泄露即可被无限制滥用73% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/526869API
curl https://kongchang.com/api/v1/knowledge/claims/526869MCP
get_claim(id=526869)