[null,null,["最后更新时间 (UTC)：2023-12-01。"],[[["\u003cp\u003ePasskeys are supported across various platforms and browsers, including Android, Chrome, iOS, Safari, Windows, and Edge, enhancing user security and convenience.\u003c/p\u003e\n"],["\u003cp\u003eThey are synchronized within a platform's ecosystem (like Android or iOS) and can be used on other platforms through QR code scanning for one-time logins.\u003c/p\u003e\n"],["\u003cp\u003eUsers can continue using existing credentials alongside passkeys, with device-bound credentials remaining available for authentication.\u003c/p\u003e\n"],["\u003cp\u003ePasskeys are end-to-end encrypted and stored securely, safeguarding user privacy even if their Google Account is compromised.\u003c/p\u003e\n"],["\u003cp\u003eDevelopers should maintain existing sign-in options alongside passkeys to support devices or platforms without passkey compatibility.\u003c/p\u003e\n"]]],[],null,["# Frequently asked questions (FAQ)\n\nGeneral\n-------\n\n### Who supports passkeys?\n\nBecause passkeys are based on FIDO standards, they work on Android and Chrome,\nalong with many other popular ecosystems and browsers such as Microsoft Windows,\nMicrosoft Edge, macOS, iOS and Safari.\n\nSee [Supported environments](/identity/passkeys/supported-environments) to check\nthe support status on Chrome and Android.\n\n### Do passkeys work on devices that don't have a screen lock method set up?\n\nIt depends on the password manager implementation, whether a credential provider\nallows for a passkey creation and authentication without a user knowledge factor\nchallenge. Providers can prompt users to set up a PIN or biometric screen lock\nbefore creating a passkey.\n\n### How can passkeys registered on one platform (such as Android) be used to sign in on other platforms (such as web or iOS)?\n\nA passkey registered on Android, for example, can be used to sign-in on other\nplatforms by connecting the [Android\nphone](/identity/passkeys/use-cases#sign-in-with-a-phone) with another device.\nTo establish a connection between the two devices users need to open the site\nthey are trying to sign in to on a device that doesn't have a passkey\nregistered, scan a QR code, and then confirm the sign-in on the device they had\ncreated the passkey on (in this case, the Android device). The passkey never\nleaves the Android device, so typically apps will suggest creating a new passkey\non the other device to facilitate the sign-in the next time. This flow will work\nin a similar way for other platforms as well.\n\n### Can I move synchronized passkeys from one platform provider to another?\n\nPasskeys are saved to the credential provider defined by the platform. Some\nplatforms, like Android, allow users to choose the provider of their choice (a\nsystem or third-party password manager) *starting in Android 14*, which\nmay be able to synchronize passkeys across different platforms. Support for\nmoving passkeys directly from one platform provider to another is not available\nat this time.\n\n### Can a user synchronize their passkeys across non-Google Android devices?\n\nPasskeys are only synced within the device's ecosystem (that is, Android to\nAndroid with [Google Password Manager](https://passwords.google/) by default),\nbut not across the ecosystem.\n\nAndroid is opening up the platform (starting in Android 14) to allow users to\nselect which credential provider they want to use (such as a third-party\npassword manager). That will enable use cases like synchronizing passkeys\nbetween different ecosystems (depending on how open other platforms are).\n\n### What should developers do about devices and platforms that don't support passkeys?\n\nDevelopers are recommended to *[keep the existing sign-in options](/identity/passkeys/developer-guide#revisit_your_existing_authentication_mechanism)*\nin their app for the time being so that they will continue to be available for\ndevices and surfaces that do not support passkeys.\n\n### Can a passkey expire?\n\nNo. This depends on the provider storing the passkeys and the RP (Relying\nparty), but there's no common practice to expire passkeys.\n\n### Can an RP specify an account for the user to sign in with?\n\nRelying parties (third-party apps) can populate the\n'[allowCredentials](https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get#publickey_object_structure)'\nwith a list of credential IDs sent from their app backend indicating which\npasskeys should be used to authenticate the user.\n\nPasskeys on Android \\& Chrome\n-----------------------------\n\n### Can Android apps use passkeys created in Chrome for authentication?\n\n- For passkeys created in Chrome on Android:\n\n Yes, the passkeys created in Chrome are saved to Google Password Manager and\n available on Android and vice versa when users are signed into the same Google\n account.\n | **Note:** The first step to enable passkey support for your Android app is to associate your app and the website. To do so, host a [Digital Asset\n | Links](https://developers.google.com/digital-asset-links) JSON file on your website, and add a link to the Digital Asset Link file to your app's manifest. This demonstrates that you own both the website and the app. To learn more, check out the [documentation](https://developer.android.com/training/sign-in/passkeys#add-support-dal) on Digital Asset Links.\n- For passkeys created in Chrome on other platforms:\n\n If the passkey is created in Chrome on other platforms (Mac, iOS, Windows),\n then no. Check out the [supported environments](https://developers.google.com/identity/passkeys/supported-environments#chromes_passkey_support_on_different_operating_systems)\n for more information. Meanwhile, users can [use the phone](https://developers.google.com/identity/passkeys/use-cases#sign-in-with-a-phone)\n they created the passkey on to sign in.\n\n### What happens to the credentials created before passkeys were introduced? Can we continue using them?\n\nYes, on both Chrome and Android, device-bound credentials created before we\nenabled synchronization, are available and can still be used for authentication.\n\n### What happens if a user loses their device?\n\nPasskeys created on Android are backed up and synced with Android devices that\nare signed in to the same Google Account, in the same way as passwords are\nbacked up to the password manager.\n\nThat means user's passkeys go with them when they replace their devices. To sign\ninto apps on a new phone, all the user needs to do is to verify themselves with\ntheir existing device's screen lock.\n\n### Are both biometric and PIN or pattern screen lock setup on the device required for signing in with passkeys or is one of these enough?\n\nOne screen lock method is enough.\n\n### Is a passkey tied to a specific screen lock method like fingerprint, PIN or pattern?\n\nIt depends on the device platform and how they run the user verification. In the\ncase of [Google Password Manager](https://passwords.google/), the passkeys are\nnot tied to any specific authentication methods and can be used with any screen\nlock factor available (biometric, PIN, or pattern).\n\n### Can an RP still create device-bound credentials that aren't synchronized?\n\nFor the time being, non-discoverable credentials created in Chrome on Android,\nor in an Android app using the Play Services APIs, keep their existing behavior\nand thus continue to be device-bound.\n\nWhen using passkeys, the [device public key extension](https://w3c.github.io/webauthn/#sctn-device-publickey-extension)\nwhich is under development is a second, device-bound key that won't be synced\nand that can be used for risk analysis. However, this is not supported by any\ncredential providers yet.\n\n### How does synchronizing passkeys to a new device work? Do users need to have access to the device they created a passkey on?\n\nOn Android:\n\n- If the passkeys were saved to [Google Password\n Manager](https://passwords.google/), then all the user needs to do is sign in\n on the new device with the same Google account and verify themselves with\n their previous device's screen lock (PIN, pattern or passcode). The previous\n device is not required for the user to login to other devices.\n\n- If the passkeys were saved to a different credential provider, it will depend\n on the sign-in flows on new devices of that credential provider. Most\n credential providers synchronize the credentials to the cloud and offer ways\n to users to access them on new devices after authenticating themselves.\n\n| **Note:** To learn more about how you can support passkeys on Android, see [Jetpack Credential Manager API for integration](https://developer.android.com/training/sign-in/passkeys). For other questions, see [Credential Manager FAQ](https://developer.android.com/training/sign-in/credential-manager-faq).\n\nPrivacy and security\n--------------------\n\n### Is the user's biometric information safe?\n\nYes, user biometric data never leaves the device and is never stored on a\ncentral server where it could be stolen in a breach.\n\n### Can a user sign in to a friend's device using a passkey on their phone?\n\nYes. Users can [set up a \"one time link\" between their phone and someone else's device](https://developers.google.com/identity/passkeys/use-cases#sign-in-with-a-phone) for the purposes of signing in.\n\n### Are passkeys stored in Google Password Manager protected if a user's Google account is compromised?\n\nYes, passkey secrets are end-to-end-encrypted. A compromised Google account\nwouldn't expose passkeys, because users also need to unlock the screen of their\nAndroid device to decrypt the passkeys.\n\nRelated topics\n--------------\n\n### How do passkeys compare to identity federation?\n\n[Identity federation](/identity/openid-connect/openid-connect) is great for\nsigning up to a service, as it returns the user's basic profile information such\nas name, and verified email address, which help bootstrap new accounts. Passkeys\nare great for streamlining users'\n[reauthentication](https://developers.google.com/identity/passkeys/use-cases#reauthentication)."]]
