# Do you know what a passkey is and how one works? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [October 14, 2026, 9:19pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842 "2026-10-14T21:19:12Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [October 14, 2026, 9:19pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/1 "2026-10-14T21:19:12Z")
Pop quiz: WITHOUT looking it up or asking an AI, do you know what a passkey is (as in website & app security)? Do you know how it works? How is it different from a password manager, a USB security key, a fingerprint scanner, or a 2FA one-time password? I’m just curious about how confusing (or not) they are to others. Do you ever use them? I _used_ to know how they work, I think, and might’ve even explained it in another post on the SDMB long ago. But time passes, memories fade, and now I’m left wondering if they were just a bygone fad. There was a real big push for them a while ago, but not so much these days. I think I still have a few saved somewhere, but I’m no longer clear on how they’re supposed to be stored and used… ---
**Author:** ![xizor](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/xizor/32/102_2.png) [@xizor](https://boards.straightdope.com/u/xizor)\ **Post date:** [October 14, 2026, 9:59pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/2 "2026-10-14T21:59:26Z")
My understanding (which may be out dated) is that a passkey differs from a password in that for a passkey, only one side knows the secret key. For a password, both the side asking for it and the side providing it have to know the actual password. So if a third party discovers the password (phishing, hack, etc), it can gain access to the goods. With a passkey, the secret key is never shared with both sides. The asking side doesn’t ask directly for a password, it asks for a verification that you know the secret key, so you do a face scan, or fingerprint reader or something and your local device says “yeah, they check out” and you gain access. More difficult (but not impossible) for third parties to look at the exchange and discover how to hack in. But I haven’t worked in cyber security for over a decade so I suspect it may be more complicated than that these days. ---
**Author:** ![robby](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/robby/32/11048_2.png) [@robby](https://boards.straightdope.com/u/robby)\ **Post date:** [October 14, 2026, 10:06pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/3 "2026-10-14T22:06:13Z")
My understanding is that a passkey is generally device-dependent, but that Apple Passwords and Google Password Manager are somehow able to exchange them between your devices. ---
**Author:** ![Dewey\_Finn](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dewey_finn/32/4222_2.png) [@Dewey\_Finn](https://boards.straightdope.com/u/Dewey_Finn)\ **Post date:** [October 14, 2026, 10:07pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/4 "2026-10-14T22:07:13Z")
No, I don’t know what passkeys are but every time I log into some websites, I’m prompted to set one up. It’s kind of annoying. ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [October 14, 2026, 10:21pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/5 "2026-10-14T22:21:53Z")
> [@Dewey\_Finn](#): > > I’m prompted to set one up. It’s kind of annoying. Heh, it’s even worse than that. I _already_ have one set up for that website (Google), but… it refuses to let me use it until I click cancel, and then _try the exact same thing again_. Apparently the first time it only asks my operating system. Only the second time onwards does it let me use my password manager (still to send a passkey). In the IT world there’s a discussion going on right now with “Did we fuck up with passkeys? Is it just super-confusing to everyone because of the shitty way it was implemented?” (Spoiler: Yes.) ---
**Author:** ![Dewey\_Finn](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dewey_finn/32/4222_2.png) [@Dewey\_Finn](https://boards.straightdope.com/u/Dewey_Finn)\ **Post date:** [October 14, 2026, 10:30pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/6 "2026-10-14T22:30:57Z")
I agree that it’s confusing. I’m a relatively sophisticated user and I don’t understand them. Other people, like my 89-year-old mother, have no chance. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 14, 2026, 10:37pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/7 "2026-10-14T22:37:21Z")
A properly-implemented passkey is the same thing as a properly-implemented password. A poorly-implemented passkey is the same thing as a poorly-implemented password. They got popular because, before they started being widely used, computer science folks were looking at the official standard for how passkeys should be implemented, and comparing that to actual real-world experience of how passwords were actually implemented, and saw that the former was far superior to the latter. But now that everyone’s gotten the message that they should be calling whatever it is they’re doing a “passkey”, actual passkeys are just as poorly implemented as actual passwords, and so it doesn’t matter what you call it. ---
**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\ **Post date:** [October 14, 2026, 10:47pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/8 "2026-10-14T22:47:14Z")
To me, the major thing with passkeys that makes them much, much more secure than passwords is that a passkey verifies **both** sides of the connection. Do you know that you’re typing your password into your bank? It looks like your bank’s website, or at least it has the bank’s name and logo on it. Passkeys use cryptography so that each side posses a secret, and each side can verify that other’s secret is the same now as it was when the passkey was created. I don’t have to know if that is my bank’s website, because unless that site possess my bank’s secret key, I’m not going to show them my passkey. (And if hackers have my bank’s secret key, then it’s all over for the bank anyway.) I’m still seeing passkeys get rolled out. Fidelity just rolled them out in the last month or so, and they do them correctly. I can click on the passkey option to login, I unlock my passkey, send it to Fidelity, and then I’m logged in. No need to enter my password first, and then my passkey, or cancel the password and then get a passkey prompt, or (I’m looking at you, Microsoft) store the passkey in _your_ app instead of the passkey manager I want to use. So to answer the OP, yes and yes (with limitations, I can’t explain the detailed math of the cryptography, but I have a general sense of what’s going on). ---
**Author:** ![Dewey\_Finn](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dewey_finn/32/4222_2.png) [@Dewey\_Finn](https://boards.straightdope.com/u/Dewey_Finn)\ **Post date:** [October 14, 2026, 10:50pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/9 "2026-10-14T22:50:48Z")
When I’m trying to connect to a website is _not_ the time to introduce me to a new idea like a passkey; at that point I just want to get to the website and make a transaction or whatever. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [October 14, 2026, 10:51pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/10 "2026-10-14T22:51:45Z")
> [@Dewey\_Finn](#): > > No, I don’t know what passkeys are but every time I log into some websites, I’m prompted to set one up. It’s kind of annoying. That’s about where I stand. I’ll add in that the little I understand of it suggests I wouldn’t be able to use it on PC/laptop with no camera or fingerprint reader. > [@echoreply](#): > > Do you know that you’re typing your password into your bank? It looks like your bank’s website, or at least it has the bank’s name and logo on it. That’s one of the advantages, I think, unless I’m mistaken, of having something autofill your username/password. Be it your browser or an extension. I always figure if it autofills, it’s the correct URL and not one that looks the same but isn’t. ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [October 14, 2026, 10:57pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/11 "2026-10-14T22:57:50Z")
Yes, I know what they are and could give a layman’s explanation of how they work and how they differ from password managers, biometrics, 2FA, etc. I’m _fairly_ technical – used to be a software developer but haven’t done much coding in the last 15 years, and never did much with security. Interestingly, while you say they seem to be falling out of favor, I’ve been noticing an increase in their usage for the past few months. I probably have a half-dozen websites that started offering to let me use a passkey since this summer (two banks, a health care provider, and a few others). The Google issue you mention sounds miserable. I haven’t experienced anything like that, so I’m pretty happy with them. What kind of confusion do you see from users? ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [October 14, 2026, 11:02pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/12 "2026-10-14T23:02:04Z")
> [@Joey\_P](#): > > That’s about where I stand. I’ll add in that the little I understand of it suggests I wouldn’t be able to use it on PC/laptop with no camera or fingerprint reader. Kind of. If the passkey is stored on your laptop or credential manager, you some way need to authenticate to that in order to “unlock” the passkey. Without any biometric options, that probably means a password or security code. So you’re still using a passkey, but it doesn’t really feel like it. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [October 14, 2026, 11:45pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/13 "2026-10-14T23:45:47Z")
This. I see more, not fewer websites bugging me to set up passkeys. I want to click “No thank you” once per lifetime dammit, not once per login. One question I’ve not seen well-addressed in any help or documentation or even layman’s explanation on a website: If I have e.g. five devices and I use all five to access e.g. Amazon with my one Amazon account, does each device have a separate passkey to that same Amazon account? Or do they all have the same passkey and if so, how to I propagate that from one device to another. They’re all different tech, different OSes, some have no TPM, no fingerprint, no camera. And how does security work when that means anyone who has my phone has all its passkeys? What else do I need to do to authenticate me to my e.g. phone so it can authenticate itself, and me indirectly, to e.g. Amazon? ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [October 14, 2026, 11:55pm UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/14 "2026-10-14T23:55:07Z")
Passkeys can either be local or shared across devices with a credential manager. That could be based on your OS (e.g., Apple iCloud Keychain, Google Password Manager, Microsoft Password Manager) or some third-party tool that you can use on a variety of devices. If you have a passkey on your phone and _someone can authenticate to your phone_, then yes, they have access to it. If they can’t get past whatever authentication you are using on your phone, then physical possession of the phone does not compromise your passkey. And to emphasize one point specifically: > [@LSLGuy](#): > > They’re all different tech, different OSes, some have no TPM, no fingerprint, no camera. Passkeys are not related to the means by which you authenticate to your phone or laptop. You use that authentication to unlock the passkey, which is then used to authenticate to the website. You can have a single passkey shared across devices with a credential manager, and you might use a completely different authentication method on each of those devices, but it’s all the same passkey. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [October 15, 2026, 12:00am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/15 "2026-10-15T00:00:33Z")
A passkey is what the staff uses to access your hotel room. > [@xizor](#): > > With a passkey, the secret key is never shared with both sides. The asking side doesn’t ask directly for a password, it asks for a verification that you know the secret key I would call that a zero-knowledge proof, which may [involve a password](https://en.wikipedia.org/wiki/Zero-knowledge_password_proof). There is also [public-key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) where you have what I would call a “secret key” which is not shared and may be used to authenticate yourself to multiple parties. ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [October 15, 2026, 12:07am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/16 "2026-10-15T00:07:13Z")
I think the “multiple devices on different platforms” question is the most confusing user-facing part of the whole passkey design. Different software will “compete” to hold & serve passkeys: - Your password manager(s) - Your web browser, especially Google Chrome - Your operating system, via its own sync mechanism (like iCloud Keychain or Windows Hello) - Your operating system, delegating to a separate hardware device like a USB YubiKey Even worse, each of these can decide how well they work with the other handlers… your password manager, for example, may or may not decide to ask you “Do you want to use the passkey I have, or check the web browser or OS one on your own?” (then passes it on) If you don’t really remember where you saved it, there is no easy way to find it again either, except to keep passing through from one layer to the next in the hopes that one of them answers with “Oh yeah, I have a passkey for this site!” before the prompt times out. If you forget to unlock your password manager, for example, it might not even show you that and the OS will just go “nope, no idea” and make it look like you have no passkey for that site at all. These different vendors are incentivized to _not_ play nice with the other ones, because each one creates an opportunity to strengthen vendor lock-in. Apple _wants_ you to keep using iCloud Keychain, because it works well between Macs and iPhones and iPads and such, especially if you’re in Safari. Once you add other companies into the mix… it gets a whole lot more fiddly and unpredictable. I use 1password between Android, Windows, and Mac, and my passkeys are something like 70% reliable. But every week or so, I need to fall back to passwords because the setup just didn’t work right for some app or site. Different websites can also choose whether they accept the syncable kind of passkey, or only the hardware-tied ones, or only the USB security-key ones. So even if you like your password manager or Windows Hello, you might not be allowed to use it for some _specific_ passkeys, even if it works for most of them. I wasn’t sure about any of this, myself, and I did eventually ask AI for an explainer: [Claude’s Passkey Field Guide](https://claude.ai/artifact/WpfZx8JX6UW8froLdc8iDP) Honestly, it’s all really confusing… good for the companies (website owners) who want stronger security, but horrible user experience for any normal person who isn’t all-in on a single-vendor ecosystem (e.g. all Apple). ---
**Author:** ![Kent\_Clark](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kent_clark/32/105_2.png) [@Kent\_Clark](https://boards.straightdope.com/u/Kent_Clark)\ **Post date:** [October 15, 2026, 12:18am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/17 "2026-10-15T00:18:46Z")
Having read through the thread this far, I’ve concluded that I want nothing to do with passkeys. ---
**Author:** ![Heracles](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/heracles/32/487_2.png) [@Heracles](https://boards.straightdope.com/u/Heracles)\ **Post date:** [October 15, 2026, 12:20am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/18 "2026-10-15T00:20:24Z")
> [@LSLGuy](#): > > And how does security work when that means anyone who has my phone has all its passkeys? What else do I need to do to authenticate me to my e.g. phone so it can authenticate itself, and me indirectly, to e.g. Amazon? I believe the idea is that your trusted device, typically your phone, is supposed to certify to the website that you are you. So it may ask for a fingerprint or a face print, but it may be less strict if your smart watch is nearby or if you’re on your home Wi-Fi. If you’ve chosen to disable all passwords and biometrics on your phone, all bets are off. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [October 15, 2026, 12:22am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/19 "2026-10-15T00:22:06Z")
That’s now my bottom line too. I had my suspicions before, but they’ve all been confirmed. And thanks to the several knowledgeable folks who’ve cut so ably through the clutter and marketing speak. I’ll keep using cross-platform BitWarden for storing old fashioned but very long passwords until they pry it away from me. ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [October 15, 2026, 12:51am UTC](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842/20 "2026-10-15T00:51:59Z")
Passkeys are built on public key cryptography. Basically when you create a passkey, you are creating a key pair for that account. The public key goes to the site, the private key is kept locally. When you log in, the site sends a challenge. Your device unlocks the private key with whatever verification method you’ve chosen, then signs the challenge using it. The site then receives the signature, and verifies it using the public key. The signature is also domain-bound, which makes phishing harder. The real secret sauce is that the stuff passing over the network is all public, and even if someone hacks the site, they only get public keys. So the weak link is typically what _you_ use on your side as your verification method to allow your side to create the signature with the private key. [Next page](https://boards.straightdope.com/t/do-you-know-what-a-passkey-is-and-how-one-works/1033842.md?page=2)