Skip to content
LockdownGuide

Password security

Passkeys vs Passwords: The Complete FIDO2 WebAuthn Migration Guide

How passkeys work under the hood with public-key cryptography, why they are immune to phishing, and how to migrate your organization.

By the LockdownGuide Editorial Team 8 min read

Passkeys represent the most significant evolution in digital identity security since the invention of the password. Developed through collaboration between Apple, Google, Microsoft, and the FIDO Alliance, passkeys replace human-memorized strings with standard asymmetric public-key cryptography.

Understanding how passkeys operate allows individuals and organizations to eliminate credential-based phishing entirely.

How Passkeys Work Under the Hood

When you register a passkey for an online account:

  1. Keypair Generation: Your device’s Secure Enclave or hardware authenticator generates a unique mathematical keypair: a private key that never leaves your device and a public key sent to the website server.
  2. Authentication Challenge: When logging in, the website sends a cryptographic challenge string.
  3. Local Biometric Verification: Your device prompts you for Face ID, Touch ID, or a device PIN to authorize the signature.
  4. Signature Verification: The device signs the challenge using the private key and returns the signature. The server verifies it against your public key.

Because the browser cryptographically binds the signature to the exact URL displayed in the address bar, an attacker cannot trick you into entering credentials on a spoofed domain.

Synced Passkeys vs Hardware Security Keys

  • Multi-Device (Synced) Passkeys: Stored in encrypted cloud keychains (iCloud Keychain, Google Password Manager, Bitwarden). When you buy a new iPhone or Android device, your passkeys sync automatically.
  • Single-Device (Hardware) Passkeys: Stored inside physical YubiKeys or Titan keys. The private key cannot be extracted or backed up to the cloud, providing high assurance for administrative infrastructure and corporate engineering access.

Sources

Frequently asked questions

Why are passkeys immune to phishing?
Passkeys use public-key cryptography where the browser cryptographically verifies the exact domain name before releasing an authentication signature, so fake lookalike phishing domains cannot intercept credentials.
What happens if you lose a device with passkeys?
Multi-device passkeys sync securely across encrypted keychains (Apple iCloud Keychain, Google Password Manager, 1Password) so new devices restore your credentials seamlessly.

About the author

Written by the LockdownGuide Editorial Team, which researches and maintains every guide on this site. Read more about our editorial standards or contact us with corrections.

Keep reading