WebAuthn: Difference between revisions

''Passkey'' is the [[de facto]] [[Technical language|non-technical]] term for a saved sign-in credential, a piece of [[cryptographic]] information that is capable of being used to authenticate a user using the WebAuthn standard.<ref name="docsrs-webauthnrs2">{{cite web |last1=Brown|first1=William|title=webauthn-rs docs|url=https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey|website=Docs.rs|publisher=Kanidm Identity Management Project|access-date=3 July 2025|date=April 2024|archive-url=https://web.archive.org/web/20250612151121/https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey|archive-date=12 June 2025}}</ref><ref name="imperialviolet-webauthn2">{{cite web |last=Langley|first=Adam|date=2024-12-23|title=A Tour of WebAuthn|url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html|access-date=2025-08-13|website=Imperial Violet}}</ref> Most user interfaces that support using WebAuthn refer to it as supporting ''passkeys''.<ref name="arstechnica-not-usable2">{{cite web |last1=Goodin|first1=Dan|title=Passkey technology is elegant, but it's most definitely not usable security|date=30 December 2024 |url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/|publisher=Ars Technica|access-date=3 July 2025|archive-date=3 July 2025|archive-url=https://web.archive.org/web/20250703130434/https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/|url-status=live}}</ref>

Due to the open-ended nature of the WebAuthn specification, a passkey can be stored on software or hardware that is capable of authenticating a user. This includes technology like [[Windows Hello]] which works by using facial recognition to authenticate users,<ref>{{Cite web |last=|title=Support for Passkeys in Windows|url=https://learn.microsoft.com/en-us/windows/security/identity-protection/passkeys/|access-date=2026-06-06|website=learn.microsoft.com|language=en-us}}</ref><ref>{{Cite web |title=Configure Windows Hello - Microsoft Support|url=https://support.microsoft.com/en-us/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0|access-date=2026-06-06|website=support.microsoft.com}}</ref> [[Bitwarden]] which authenticates users through a [[browser extension]]<ref>{{Cite web |title=Log In With Passkeys|url=https://bitwarden.com/help/login-with-passkeys/|access-date=2026-06-06|website=Bitwarden|language=en}}</ref> or [[YubiKey]]s that allow a user to authenticate using a physical hardware token.<ref>{{Cite web |last=|first=|last2=|title=Stop changing weak passwords. Start replacing them with passkeys|url=https://www.pcworld.com/article/2591499/stop-changing-weak-passwords-start-replacing-them-with-passkeys.html|access-date=2026-06-06|website=PCWorld|language=en}}</ref> The cryptographic keys stored by the software are only available to use for the browser once the software or hardware is authenticated the user.<ref name="arstechnica-not-usable2" />

When Apple first prominently introduced passkeys to the public in 2022,<ref>{{cite news |last1=Clemons|first1=Taylor|title=WWDC 2022: Apple announces Passkey feature to eliminate passwords across platforms|url=https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/|access-date=4 July 2025|publisher=ZD Net|date=6 June 2022|archive-date=6 June 2023|archive-url=https://web.archive.org/web/20230606212207/https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/|url-status=live}}</ref> they emphasized integrations with their own products. This, combined with the lack of clear communication from other companies, led to speculation that passkeys were proprietary to Apple.<ref>{{cite news |last1=Shakir|first1=Umar|title=Reminder: passkeys are not just from Apple|url=https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft|access-date=4 July 2025|publisher=The Verge|date=6 August 2022|archive-date=24 September 2023|archive-url=https://web.archive.org/web/20230924231545/https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft|url-status=live}}</ref> As browsers and websites began to implement WebAuthn, the inconsistent feature-sets have often resulted in a variety of understandings of what exactly counted as a passkey.<ref name="arstechnica-not-usable2" />