On this page
What are passkeys?
A passkey is a sign-in credential built from a device-bound key pair. The device creates the pair when you register, keeps the private half, and gives the site the public half.
FIDO2 is the standard underneath. It has two parts: WebAuthn, the API a browser exposes, and CTAP, the protocol a browser uses to talk to an external authenticator such as a security key. Passkey is the consumer-facing name for the credential those specifications produce.
How do FIDO2 and passkeys work?
At sign-in the site sends a fresh random challenge. The device signs it with the private key and returns the signature, and the site checks that signature against the public key it stored at registration. A valid signature proves the right device answered.
The private key never leaves the device. A local check unlocks it, and that check can be a PIN, a fingerprint, or a face reading handled by the operating system.
Registration creates a per-site key
The key pair is scoped to one relying party, so a credential made for one site means nothing at another. There is no single credential to reuse across your accounts.
Discoverable credentials remove the username
A resident passkey lets the device offer the right account itself. That is why a passkey sign-in can start with no typing at all.
Synced and device-bound passkeys differ
A platform passkey often syncs through a cloud keychain, so a lost phone is not a lockout. A security key keeps the credential on the hardware. The synced version trades some assurance for recoverability, and that trade is yours to make.
Why are passkeys phishing-resistant?
The browser checks the site origin before the device is allowed to sign. A lookalike domain is a different origin, so the passkey stays silent and the user is never asked to notice the difference.
There is also nothing to hand over. No code appears on screen and no secret is sent, so a real-time proxy has no value to relay. Origin binding plus no shared secret is what earns the phishing-resistant label.
What does a passkey prove, and what are its limits?
A passkey proves that a request came from a registered device. That is a strong statement about hardware and a weaker one about people. Everything else rests on the local unlock, which is an operating-system control the relying party cannot see or measure.
For most consumer sign-ins that trade is correct. For a payout approval, a shared workstation, or a regulated action, ask whether device possession is really the fact you needed.
Possession is the core claim
A valid signature means the enrolled device took part in the ceremony. It does not say who was holding it.
The unlock is out of your hands
A device PIN can be shared or watched, and an unlocked phone can be passed to another person. The relying party receives no evidence about which of those happened.
Recovery is the soft edge
Recovery after a lost device usually falls back to an email link or a code. That fallback is often the weakest link in an otherwise phishing-resistant design.
How does SenseCrypt compare with passkeys?
SenseCrypt is a passwordless identity provider (IdP), so the comparison is not passkey against face. It is device possession against person presence, and the two answer different questions.
A user enrolls from a photo already on file and then signs in by face. The match runs on the device, and the server stores no face image and no face template.
Both remove the password
Neither method has a secret a user could be talked into revealing. On phishing they are on the same side.
The claim is different
A passkey says this device signed. SenseCrypt says the enrolled person was present at the enrolled device, which is what you want before a high-value action.
Enrollment happens once, at the IdP
Passkeys are registered per relying party. SenseCrypt enrolls the person once, and every connected application receives a standard token or assertion.
Liveness is certified
Capture is checked for presentation attacks, and that liveness holds iBeta ISO 30107-3 certification at Level 1 and Level 2. Capture is 2D RGB, so no depth sensor is needed.
Frequently asked questions
What are passkeys in simple terms?
A passkey is a device-bound key pair for sign-in. It replaces a password. The device keeps the private key, and the site keeps the public key.
Are passkeys phishing-resistant?
Yes. A passkey binds to one site domain. A fake site has the wrong domain, so the passkey does not respond.
How does SenseCrypt differ from a passkey?
A passkey proves that a user holds a device. SenseCrypt proves the enrolled person by face. Face matching runs on-device. SenseCrypt stores no face image and no face template.
Related