Passwordless login with passkeys

Passkeys

Introduction

Passkeys are a safer and easier replacement for passwords. With passkeys, users can sign in to apps and websites with a biometric sensor (such as a fingerprint or facial recognition), PIN, or pattern, freeing them from having to remember and manage passwords.

A passkey can replace a password and a second factor in a single step. The user experience can be as simple as autofilling a password form. Passkeys provide robust protection against phishing attacks, unlike SMS or an app based one-time passwords. Since passkeys are standardized, a single implementation enables a passwordless experience across different browsers and operating systems.

What are passkeys?

A passkey is a digital credential, tied to a user account and a website or application. Passkeys allow users to authenticate without having to enter a username, password, or provide any additional authentication factor. This technology aims to replace legacy authentication mechanisms such as passwords.

When a user wants to sign in to a service that uses passkeys, their browser or operating system will help them select and use the right passkey. The experience is similar to how saved passwords work today. To make sure only the rightful owner can use a passkey, the system will ask them to unlock their device. This may be performed with a biometric sensor (such as a fingerprint or facial recognition), PIN, or pattern.

To create a passkey for a website or application, a user first must register with that website or application.

  1. Go to the application and sign in using the existing sign-in method.
  2. Click Create a passkey button.
  3. Check the information stored with the new passkey.
  4. Use the device screen unlock to create the passkey.

When they return to this website or app to sign in, they can take the following steps:

  1. Go to the application.
  2. Click Sign in.
  3. Select their passkey.
  4. Use the device screen unlock to complete the login.

The user's device generates a signature based on the passkey. This signature is used to verify the login credential between the origin and the passkey.

A user can sign into services on any device using a passkey, regardless of where the passkey is stored. For example, a passkey created on a mobile phone can be used to sign in to a website on a separate laptop.

How do passkeys work?

Passkeys are intended to be used though operating system infrastructure that allows passkey managers to create, backup, and make passkeys available to the applications running on that operating system. On Chrome on Android, passkeys are stored in the Google Password Manager, which synchronizes passkeys between the user's Android devices that are signed into the same Google account.

Users aren't restricted to using the passkeys only on the device where they're stored—passkeys stored on phones can be used when logging into a laptop, even if the passkey isn't synchronized to the laptop, as long as the phone is near the laptop and the user approves the sign-in on the phone. As passkeys are built on FIDO standards, all browsers can adopt them.

For example, a user visits example.com on their Chromebook. This user has previously logged into example.com on their iOS device and generated a passkey. On the Chromebook, the user chooses to sign in with a passkey from another device. The two devices will connect and the user will be prompted to approve the use of their passkey on the iOS device, for example, with FaceID. After doing so, they're signed in on the Chromebook. Note that the passkey itself isn't transferred to the Chromebook, so typically example.com will offer to create a new passkey there. That way, the phone isn't required next time the user wants to sign in. Read Sign-in with a phone to learn more.

Passkey synchronization

Privacy considerations

  • Some users may be surprised if a biometric authentication suddenly appears on a website or an app and think this is sending sensitive information to the server. With passkeys, the user's biometric information is never revealed to the website or the app. Biometric material never leaves the user's personal device.
  • Passkeys on their own don't allow tracking users or devices between sites. The same passkey is never used with more than one site. Passkey protocols are carefully designed so that no information shared with sites can be used as a tracking vector.
  • Passkey managers protect passkeys from unauthorized access and use. For example, the Google Password Manager encrypts passkey secrets end-to-end. Only the user can access and use them, and even though they're backed up to Google's servers, Google can't use them to impersonate users.

Security considerations

  • Passkeys use public key cryptography. Public key cryptography reduces the threat from potential data breaches. When a user creates a passkey with a site or application, this generates a public–private key pair on the user's device. Only the public key is stored by the site, but this alone is useless to an attacker. An attacker can't derive the user's private key from the data stored on the server, which is required to complete authentication.
  • Because passkeys are bound to a website or app's identity, they're safe from phishing attacks. The browser and operating system ensure that a passkey can only be used with the website or app that created them. This frees users from being responsible for signing in to the genuine website or app.

Get notified

Subscribe to the Google passkeys developer newsletter to get notified about passkey updates.

Next steps