IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Passkeys & WebAuthn
Maya wants to sign in without a password. A passkey uses two linked keys. One stays on her device. The website keeps the other. Your goal: explain how a passkey signs you in and why it cannot be phished.
- A passkey is a pair of linked keys, private and public.
- The private key never leaves your device.
- The device signs a fresh challenge. The site checks it.
- A passkey works only on the real website.
What a passkey is
When you make a passkey, your phone or laptop creates a key pair. These are two keys that belong together.
The private key stays on your device. You unlock it with your fingerprint, face or PIN. Your fingerprint never goes to the website.
The public key goes to the website. It cannot sign anything. It can only check a signature.
The website you sign in to is called the relying party.
Your bank keeps a sample of your signature. It can check a cheque against the sample. It cannot sign a cheque for you. The sample is the public key. Your pen is the private key.
📝 Register
Your device makes a new key pair for this one site. It locks the private key behind your fingerprint, face or PIN. It sends the public key to the site.
🔓 Authenticate
The site sends a random one-time number, a challenge. Your device signs it after you unlock it. The site checks the signature with the public key.
The rules for this are called WebAuthn. It was made by the W3C and the FIDO Alliance. Modern browsers and phones support it.
Why phishing fails
Each passkey belongs to one site name. This name is the relying-party ID. It is the site's own domain, such as shop.example.
Your browser offers the passkey only on that domain. A fake page on another domain gets nothing. There is nothing to type, paste or approve there.
The challenge is new every time. An old signature is useless if someone copies it.
Passwords and SMS codes can be tricked out of you. A passkey cannot.
Maya gets an SMS: "Your bank account will be blocked. Tap here." The page looks just like her bank. She tries to sign in. Her phone offers no passkey, because the address is not her bank's. The thief gets nothing. To spot fakes like this, read Spotting phishing and fake logins.
Synced or device-bound?
A synced passkey is copied between your devices with end-to-end encryption. If you lose one phone, your other devices still have it. A device-bound passkey lives on one security key or device. It has no cloud copy. It is harder to steal, but you must keep a spare.
Who is the relying party?
The relying party decides where a passkey works. In model A, the app itself is the relying party. The passkey works only for that app. In model B, a hosted login page is the relying party. One "global" passkey works for every app behind it. In model C, a native phone app uses the phone's own passkey system, linked to the provider's domain.
Go deeper: standards and assurance levels
The signature also covers the exact address of the page that asked. That is why a fake page cannot reuse it.
The US standard NIST SP 800-63-4 (final in 2025) accepts synced passkeys at assurance level AAL2. The top level, AAL3, needs a key that cannot be exported, such as a hardware security key.
A passkey sign-in can be marked acr: phr in the token. It means "phishing-resistant". This value comes from OpenID. An API can require it for risky actions. See step-up & assurance.
Go deeper: more about passkeys
FIDO2 has two parts. WebAuthn is the part in the browser. CTAP is how the browser talks to a security key or a phone.
With the "hybrid" method, you use the passkey on your phone to sign in on another computer. You scan a QR code. The phone and computer connect over Bluetooth.
A device can also prove its make and model with attestation. Most sites do not need this.
In August 2026, WebAuthn Level 3 became an official W3C Recommendation. It adds related origins. A small set of related domains can share one passkey.
FIDO is also working on a standard way to move passkeys between providers.
A passkey is not a session. It stays on your device for next time. Signing out means ending your session on the server. See sessions & sign-out.
Recovery is the hard part. Keep a recovery code and a second factor. Never make recovery depend on the passkey itself. See safe account recovery.
🧪 Interactive lab — enable JavaScript to play with this one.
Grade your own WebAuthn setup with Passkey Check.