--- title: "Passkeys — Identity Glossary | IDSync" description: "Passkeys are phishing-resistant, password-replacing credentials based on FIDO2/WebAuthn that are synced across a user's devices via their platform or…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Passkeys", "item": "https://idsync.com/glossary/passkeys" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/passkeys", "name": "Passkeys", "alternateName": [ "Passkey", "Discoverable credential" ], "description": "Passkeys are phishing-resistant, password-replacing credentials based on FIDO2/WebAuthn that are synced across a user's devices via their platform or password manager.", "url": "https://idsync.com/glossary/passkeys", "inDefinedTermSet": "https://idsync.com/glossary" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Are passkeys MFA?", "acceptedAnswer": { "@type": "Answer", "text": "On modern platforms passkeys typically combine possession (the device with the private key) and inherence (the biometric used to unlock it). They satisfy MFA requirements in most frameworks and they're phishing-resistant — which TOTP and SMS aren't." } }, { "@type": "Question", "name": "Do passkeys work cross-platform?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, both via cross-device sign-in (a QR code that uses your phone to authenticate to a laptop on a different ecosystem) and via cross-platform password managers." } }, { "@type": "Question", "name": "What's the difference between a passkey and a YubiKey?", "acceptedAnswer": { "@type": "Answer", "text": "A YubiKey can hold device-bound FIDO2 credentials — those are passkeys that don't sync. \"Passkey\" by itself usually refers to the synced flavor." } } ] } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Passkeys Authentication # Passkeys Passkeys are phishing-resistant, password-replacing credentials based on FIDO2/WebAuthn that are synced across a user's devices via their platform or password manager. Last reviewed 3 months ago Key points - Passkeys are FIDO2 credentials, but stored and synced by the OS / browser / password manager — not stuck on one device. - They eliminate phishing because the credential is cryptographically bound to the website's origin. - They unlock with the device's local biometric (Face ID, Touch ID, Windows Hello) — but the biometric stays on-device. - Apple, Google, and Microsoft sync passkeys across their respective ecosystems; 1Password, Dashlane, and Bitwarden sync cross-platform. - Device-bound passkeys (e.g. on hardware security keys) are the strongest variant — required for some regulated workflows. ## What are passkeys? Passkeys are a user-friendly form of [FIDO2](/glossary/fido2) credentials designed to replace passwords entirely. Under the hood a passkey is a public/private key pair generated on the user's device. The private key never leaves the device (or the encrypted sync fabric). The public key is registered with the website. When the user signs in, the website challenges the device, the device signs the challenge with the private key — typically after a local biometric check — and the website verifies the signature. Passkeys are **phishing-resistant by design**: the credential is bound to the website's origin by the browser, so a lookalike phishing site simply cannot complete the ceremony. ## What's different from older FIDO2 keys? The FIDO2 protocol has existed since 2018. The breakthrough with passkeys (2022) is **portability**: - **Synced passkeys** are backed up and synced across the user's devices via their platform account (Apple iCloud Keychain, Google Password Manager, Microsoft account) or a third-party password manager (1Password, Dashlane, Bitwarden). - **Device-bound passkeys** live on a single device or hardware key (YubiKey, SoloKey) and never leave it. For consumer and workforce apps, synced passkeys are the default — they solve the "I lost my one device, now I'm locked out" problem that held FIDO back for years. ## When buyers care Add passkey support when: - You're a [CIAM](/glossary/ciam) buyer and want to reduce account-takeover and password-reset support costs. - You're a workforce identity buyer chasing phishing-resistant MFA for compliance or insurance. - You're a SaaS vendor and your buyers are asking for it (increasingly common). For high-assurance workflows (admin, financial transactions, healthcare), prefer **device-bound** passkeys on hardware keys — synced passkeys are only as strong as the sync account's recovery flow. ## How rollout typically goes 1. **Phase 1:** Offer passkeys as an additional MFA option alongside TOTP/SMS. 2. **Phase 2:** Make passkey the _preferred_ sign-in method on the login page. 3. **Phase 3:** Allow passkey-only accounts (no password fallback) for opted-in users. 4. **Phase 4:** Deprecate password registration for new accounts. Most organizations live in Phase 2 for a long time. ## Common pitfalls - **Recovery is the hard part.** If the user loses their sync account, they lose their passkeys. Plan recovery flows that don't reintroduce phishable factors. - **Treating synced passkeys as device-bound** in compliance documentation. Auditors increasingly care about the distinction. - **Forgetting the "AAGUID" check** when you need to restrict which authenticator vendors are allowed (regulated environments). ## FAQ ### Are passkeys MFA? On modern platforms passkeys typically combine possession (the device with the private key) and inherence (the biometric used to unlock it). They satisfy MFA requirements in most frameworks and they're phishing-resistant — which TOTP and SMS aren't. ### Do passkeys work cross-platform? Yes, both via cross-device sign-in (a QR code that uses your phone to authenticate to a laptop on a different ecosystem) and via cross-platform password managers. ### What's the difference between a passkey and a YubiKey? A YubiKey can hold device-bound FIDO2 credentials — those are passkeys that don't sync. "Passkey" by itself usually refers to the synced flavor. ## Standards & references - [FIDO Alliance — Passkeys](https://fidoalliance.org/passkeys/) - [W3C WebAuthn Level 3](https://www.w3.org/TR/webauthn-3/) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [mfa](/directory/category/mfa)[ciam](/directory/category/ciam)[iam platforms](/directory/category/iam-platforms) ### Related terms [fido2](/glossary/fido2)[webauthn](/glossary/webauthn)[phishing resistant mfa](/glossary/phishing-resistant-mfa)[passwordless](/glossary/passwordless) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the mfa category. [Explore tools](/directory/category/mfa) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.