How Passkeys Work—and Where Their Security Limits Are
Summary
An accessible guide explains how passkeys use device-held private keys to resist phishing, while covering risks from account recovery, backup passwords, stolen sessions, compromised sync accounts and unlocked devices.
Key points
- A passkey uses a device-held private key to sign a website's challenge; the site stores the corresponding public key.
- Passkeys are tied to the website address, so a fake site cannot use a passkey created for the legitimate site.
- Passkeys reduce risks from password phishing, reuse and website database breaches, but do not secure every part of an account.
- SMS or email recovery and backup passwords can remain paths attackers target.
- Malware may steal session cookies, and attackers who gain account access may add their own passkey.
- The article recommends protecting the account that syncs passkeys, reviewing registered passkeys, removing weaker recovery options where possible, and keeping devices updated and locked.
Article Details
- Topic
- Passkey security, phishing resistance, and account recovery risks
Vendors
AppleGoogle, Microsoft, Apple, Amazon, your bank. Suddenly everyone wants you to create a passkey. You click “Not now”, and next time the pop-up is back.GoogleGoogle, Microsoft, Apple, Amazon, your bank. Suddenly everyone wants you to create a passkey. You click “Not now”, and next time the pop-up is back.MicrosoftGoogle, Microsoft, Apple, Amazon, your bank. Suddenly everyone wants you to create a passkey. You click “Not now”, and next time the pop-up is back.