How Passkeys Actually Work—Explained Simply
Passkeys let you sign in without typing a password. But what actually happens when you use one, and how does the website know it’s you?
Start with three parts:
- A supported device, app, or hardware key that can create, store, and use your passkey.
- Your private key, the secret part that is never given to the website.
- Your public key, which the website stores when you create the passkey.
Your private key may stay on one device or be securely synced through your passkey manager. Your fingerprint, face, or PIN unlocks permission to use it. FIDO Alliance explains these basics here.
Signing in starts with a challenge. The website sends a random, one-time challenge. Your device uses your private key to calculate an answer and sends that answer back.
The website then checks three things together: the original challenge, your returned answer, and the public key saved for your account. That check tells it whether the answer was produced using the matching private key.
The public key can check the answer, but it cannot practically create it. Your private key never needs to be sent to the website. And because each challenge is new, a recorded answer cannot simply be reused for a later sign-in. The WebAuthn Guide walks through this process.
Passkeys also resist phishing because they are tied to the website they were created for. A lookalike website cannot simply ask for and receive your real site’s passkey proof. Learn more from FIDO Alliance.
Before making the switch, verify your recovery options for both your accounts and your passkey manager. Then add and test your passkeys. Start with a few important accounts, and keep track of where you save them.
LEARN MORE ABOUT PASSKEYS
- Passkeys explained and common questions — FIDO Alliance
- How registration and sign-in work — WebAuthn Guide
WANT THE MATH?
- Elliptic-curve cryptography, starting with the foundations — Andrea Corbellini
- How digital signatures are created and verified, including the equations and why they work — Andrea Corbellini
These articles explain elliptic-curve cryptography and ECDSA. The exact algorithm and curve can vary between passkey implementations.
RELATED VIDEOS
- What are Digital Signatures? — Computerphile
- Elliptic Curves — Computerphile
- Passkeys Explainer Video — FIDO Alliance
COMING NEXT
How to choose a password manager and switch from your built-in manager to Bitwarden.
