Passkey

A passkey is a phishing-resistant FIDO2 credential stored in an operating system keychain (Apple Keychain, Google Password Manager, Windows Hello), a browser, or an authenticator app (Microsoft Authenticator, 1Password). Passkeys sync across a user's devices via the keychain provider's cloud sync (with E2E encryption), so a passkey created on iPhone works on iPad and Mac. They're authenticated with biometrics or a device PIN, never transmitted, and inherently resistant to phishing and replay. Microsoft Entra ID supports passkeys natively via Microsoft Authenticator and is expanding OS-native passkey support across platforms.

Passkey vs a FIDO2 hardware key — same cryptography, different custody

A passkey and a physical FIDO2 security key rely on the identical underlying protocol and origin-binding property — the phishing resistance is the same. What differs is where the private key lives and who controls its portability. A hardware key holds its private key on the device itself, never leaving it, and works with any machine the key is physically plugged into or tapped against. A passkey's private key is instead held (and synced) by a platform provider's keychain — meaning it's available automatically on every device signed into that same Apple ID, Google account, or Microsoft account, without carrying a separate physical object, but also meaning its security ultimately depends on the strength of that platform account and its own recovery process.

Worked example

An employee registers a passkey for their Microsoft 365 account using Windows Hello on their work laptop. Because that passkey is stored via Windows Hello's local platform authenticator rather than synced through a cloud keychain in this particular configuration, it stays bound to that one device — if the employee needs to sign in from a personal phone, that specific passkey isn't available there and a different registered method is needed. Contrast this with a consumer scenario: a person sets up a passkey for a personal account through their phone's OS-level password manager, which syncs it (end-to-end encrypted) to their tablet and laptop signed into the same account — from any of those synced devices, the same passkey works with no separate registration step, because the platform keychain treats it as one credential shared across the whole device family rather than one bound to a single machine.

Discoverable credentials and usernameless sign-in

Passkeys are typically discoverable credentials — the authenticator itself can enumerate which accounts it holds a passkey for, which enables a genuinely usernameless sign-in flow: a user visits a sign-in page, taps "sign in with a passkey," and their device or browser presents the relevant stored credential without the user having to type a username first. This is a meaningful usability shift from a hardware FIDO2 key, which more commonly still expects a username to be typed before the key is used to complete the challenge.

Common pitfalls

Organisations evaluating passkeys for corporate identity need to think carefully about which keychain is doing the syncing — a passkey synced through a personal Apple ID or Google account on an employee's own device ties a work-account credential's portability to a consumer account the organisation doesn't control or manage, which is a materially different risk profile from a hardware key or a device-bound platform authenticator the organisation can inventory and revoke independently of any personal cloud account.