Beyond the Password: How Passkeys Work Under the Hood

Passwords are broken. They get leaked in database breaches, reused across platforms, and phished through clever domain spoofs. While Multi-Factor Authentication (MFA) helps, standard SMS or OTP codes still leave major security gaps. Enter Passkeys : a modern authentication standard built on top of WebAuthn and FIDO2 specifications designed to eliminate shared secrets entirely. Here is a dive into the underlying cryptography, architectural flow, and why passkeys are inherently phishing-proof. The Core Concept: Asymmetric Cryptography Traditional authentication relies on shared secrets . Both you and the server know your password (or a hashed version of it). To verify who you are, you send that secret over the network. Passkeys replace shared secrets with asymmetric (public/private key) cryptography : Private Key: Generated locally on your device and stored inside a Hardware Security Module (like Apple's Secure Enclave, Android's Titan chip, or a YubiKey) or an end-to-end encrypted sync service (iCloud Keychain, 1Password, Google Password Manager). It never leaves your device unencrypted. Public Key: Registered with and stored by the website (the Relying Party). It is completely public and mathematically useless to an attacker on its own. Architectural Breakdown: How It Works Passkey operations consist of two cryptographic phases: Registration and Authentication . Phase 1: Registration (Generating the Keypair) When you create a passkey for a service (e.g., app.example.com ): Challenge Request: Your client initiates registration. The server generates a cryptographic challenge (a high-entropy random string) and sends it back alongside origin metadata ( RP ID ). Local Verification: Your browser hands this request to the OS/authenticator, which prompts for user verification—biometrics (Face ID/Touch ID/Windows Hello) or a hardware PIN. KeyPair Generation: Once unlocked, the hardware generates a unique keypair bound exclusively to app.example.com . Public Key Registration: