# What is a Passkey?

> A passkey is a discoverable FIDO credential used for passwordless authentication.

- Canonical URL: https://yellowcube.eu/glossary/passkey/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

An authenticator creates a public–private key pair scoped to a particular relying party, such as a website or application. The service stores the public key; the private key remains under the control of an authenticator or passkey provider and is used to sign a fresh challenge during authentication.

The user normally authorizes use of the passkey with the same local mechanism used to unlock a device or security key, such as a PIN or biometric. That biometric is processed locally rather than sent to the service. Because WebAuthn binds authentication to the relying party and origin, a correctly implemented passkey is resistant to conventional credential phishing and cannot be reused at a look-alike service.

### Key points

- **Two deployment forms:** A synced passkey can be made available across devices through a passkey provider; a device-bound passkey remains on a particular authenticator.
- **No shared password:** A breached service database contains a public key rather than a reusable authentication secret.
- **User verification:** Policy can require the authenticator to verify the user locally, but assurance depends on the authenticator, configuration, and recovery model.
- **Lifecycle needs:** Services must support secure registration, additional authenticators, device loss, revocation, provider changes, and auditable recovery.
- **Important limitation:** Passkeys do not secure an already stolen session or compensate for weak account recovery, unsafe enrollment, compromised endpoints, or excessive authorization after sign-in.

### Related terms

[Passwordless authentication](<https://yellowcube.eu/glossary/passwordless-authentication/>) · [Multi-factor authentication (MFA)](<https://yellowcube.eu/glossary/multi-factor-authentication/>) · [Phishing](<https://yellowcube.eu/glossary/phishing/>) · [Password manager](<https://yellowcube.eu/glossary/password-manager/>)

### Sources

[FIDO Alliance: Passkeys](https://fidoalliance.org/passkeys/) · [W3C: Web Authentication Level 3](https://www.w3.org/TR/webauthn-3/) · [NIST SP 800-63B-4: Authentication and Authenticator Management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.