Passkeys
A passwordless authentication scheme based on the FIDO2 standard that replaces conventional passwords with public-private key pairs. The private key is stored in a device's trusted execution environment or hardware security module, while the server stores only the public key, achieving phishing-resistant authentication through domain-bound signature verification.
Timeline (last 90 days)
Passkeys' private keys are stored in the user device's trusted execution environment (TEE) or hardware security module (HSM), and the server only stores the public key.
Passkeys signatures are bound to a specific domain, so phishing sites cannot obtain credentials usable on other sites.
The FIDO2 specification itself does not require Passkeys synchronization; synchronization is merely an optional product-layer capability, not a protocol mandate.
Early Passkeys did indeed lack a standardized export format, and related specification work has been ongoing, with the channel for cross-platform migration being filled in.
Passkeys' private keys are bound to the device, and once all holding devices are lost, the recovery path depends on the platform account and backup mechanisms.
For users with high-threat models (journalists, activists, high-risk enterprises), hardware keys plus an independent recovery scheme are still necessary.
All Facts (6)
Passkeys' private keys are stored in the user device's trusted execution environment (TEE) or hardware security module (HSM), and the server only stores the public key.
50%UnverifiedPasskeys signatures are bound to a specific domain, so phishing sites cannot obtain credentials usable on other sites.
50%UnverifiedThe FIDO2 specification itself does not require Passkeys synchronization; synchronization is merely an optional product-layer capability, not a protocol mandate.
50%UnverifiedEarly Passkeys did indeed lack a standardized export format, and related specification work has been ongoing, with the channel for cross-platform migration being filled in.
50%UnverifiedPasskeys' private keys are bound to the device, and once all holding devices are lost, the recovery path depends on the platform account and backup mechanisms.
50%UnverifiedFor users with high-threat models (journalists, activists, high-risk enterprises), hardware keys plus an independent recovery scheme are still necessary.
50%