How Passkeys Work in Modern Web Browsers and Operating Systems

Traditional online authentication depends on shared secrets that can be phished, leaked from databases, or intercepted during transmission. Understanding how passkeys work requires examining the Web Authentication API, an open technical specification published by the World Wide Web Consortium and the FIDO Alliance. Instead of asking users to create and type memorable strings, passkeys rely on asymmetric key pairs generated directly inside consumer devices. The private key remains locked on the user’s phone, laptop, or hardware security token, while the remote web server stores only a matching public key. This architectural shift prevents credential stuffing and phishing by ensuring that no reusable secret ever travels across the public internet [5].

Foundations of Asymmetric Cryptography

For more than sixty years, computing systems have relied on passwords to verify human identity across digital networks. That architecture exposes millions of accounts whenever a centralized server database leaks. Security researcher Adam Langley compares public key cryptography to a public mailbox at a post office, where anyone can deposit a letter through the slot using a public key, but only the mail carrier who holds the matching private key can unlock the door and retrieve the mail [13]. Because the mathematical foundation of asymmetric encryption separates the ability to verify a digital signature from the ability to generate one, web applications do not need to store sensitive secrets that attackers can exploit [4]. The system verifies the user without keeping any information that an adversary could steal.

Centralized credential stores create lucrative targets for cybercriminals. The breach tracking service haveibeenpwned.com documents roughly 13.5 billion compromised accounts originating from nearly 800 separate website leaks. When attackers steal password hashes, they can run automated cracking dictionaries offline without triggering server alerts. Users also recycle passwords across multiple web services, allowing a single leak to compromise several accounts [13].

Data breach records confirm the severity of credential theft across the industry. Verizon’s 2026 Data Breach Investigations Report found credential abuse present in 39% of all breaches, ranking as the most prevalent attack method [5]. The World Wide Web Consortium and the FIDO Alliance addressed this crisis by finalizing WebAuthn Level 1 in March 2019 [14]. By replacing passwords with digital signatures, the standard eliminates server-side exposure during routine logins [10].

How Passkeys Work During User Registration

The registration ceremony establishes a trust relationship between a client device and a web application without transmitting passwords. When an individual creates a passkey on a website, the application server acts as a relying party and generates a cryptographic challenge [7]. This challenge consists of a random buffer of at least 16 bytes designed to stop replay attempts [6].

The client browser forwards the server challenge to the operating system’s authenticator using the navigator.credentials.create() programming interface [6]. Before generating cryptographic material, the authenticator demands an explicit authorization gesture from the user to confirm consent [12]. The user completes this step by presenting a biometric fingerprint, scanning their face with Touch ID or Face ID, or entering an operating system PIN [4]. Once authorized, the authenticator generates an asymmetric key pair inside tamper-resistant hardware like a Trusted Platform Module or Apple’s Secure Enclave [5]. The private key remains locked inside that hardware chip permanently. The authenticator then signs the challenge and packages the public key into an attestation object [7].

The browser sends the resulting PublicKeyCredential object back to the web application server [6]. Supported algorithms include ES256, which uses elliptic curve P-256 and carries the identifier -7, and RS256 with identifier -257. The server verifies that the challenge matches its active registration session and stores the public key with the user’s account ID [7]. That stored public key cannot decrypt data or generate signatures on its own [13].

Authentication Ceremonies and Cryptographic Challenges

Logging in with a passkey mirrors the registration handshake while using the previously enrolled private key to produce an assertion. When an account owner visits a sign-in page, the relying party server generates a fresh cryptographic challenge and returns it to the client browser [10]. The browser calls navigator.credentials.get(), passing the server challenge, the expected domain identifier, and a list of permitted credential identifiers [7]. This API invocation directs the browser to query local authenticators for matching cryptographic keys [6]. Because the challenge changes on every attempt, an eavesdropper who intercepts a transmission cannot replay that signature to authenticate in the future [13]. Every transaction requires a distinct cryptographic proof.

The device prompts the user to verify their identity through local biometrics or a security PIN. WebAuthn distinguishes between simple user presence, such as tapping a hardware key, and full user verification, which confirms a specific user through Touch ID, Face ID, or Windows Hello [10]. Once authorized, the authenticator signs the challenge and increments an internal signature counter [5].

The client returns the signed assertion to the web server, which checks the signature against the stored public key [7]. The server also verifies that the signature counter has incremented, protecting the account against cloned authenticators [5]. During early browser testing in Firefox 60, Dropbox programmer Brad Girardeau said: “You can feel confident when signing in that it’s really us, and we can be confident it’s really you” [3]. The process finishes in fractions of a second [4].

Why Are Passkeys Safer Than Shared Secrets?

Traditional passwords fail because shared secrets must travel across networks and remain stored in corporate databases. Attackers intercept them through phishing proxies, credential stuffing bots, and database intrusions. In May 2021, ransomware operators breached Colonial Pipeline through an unused virtual private network account protected by a single shared password, forcing fuel line shutdowns and a $4.4 million ransom [5].

Common multi-factor authentication methods such as SMS text messages and mobile authenticator apps also struggle against modern adversary-in-the-middle phishing proxies. In 2023, MGM Resorts suffered an estimated $100 million financial hit after social engineering against identity workflows enabled attackers to bypass corporate access controls [5]. Reverse proxy tools can capture session cookies and one-time numeric codes in real time by displaying deceptive login portals to unsuspecting users [9]. Passkeys defang these attacks at the browser level because cryptographic credentials bind directly to legitimate web domains [10]. The browser refuses to sign an authentication challenge if the website domain does not match the original registration origin [9]. A fake site receives nothing useful.

Beyond stopping account takeovers, removing passwords eliminates significant operational expenses. A study by Yubico cited by the W3C revealed that corporate employees spend 10.9 hours per year entering or resetting passwords, costing businesses an average of $5.2 million annually. Stolen or weak credentials caused 81 percent of data breaches analyzed in that report [14]. Passkeys replace that recurring friction with a fast biometric confirmation that cannot be forgotten or intercepted [4].

Origin Binding and Defeating Phishing Attacks

The primary reason passkeys resist phishing is origin binding, a security guarantee enforced directly by the client browser. When a user authenticates, the browser inspects the active browser window’s fully qualified origin and hashes that value into an internal data structure called clientDataJSON [7]. This browser-level check operates independently of user vigilance, meaning individuals do not have to spot deceptive character swaps or lookalike internationalized domain names. Even if a user clicks a link leading to a fraudulent portal such as exampl3.com, the browser notes the hostile domain and passes that specific origin to the local authenticator [13]. The resulting signature proves access to the fraudulent site rather than the intended service. The attacker cannot alter that origin data.

When the fraudulent website proxies that authentication token to the genuine server at example.com, verification fails at once. The genuine server checks the origin embedded within the signature, detects the mismatch, and drops the connection [13]. The attacker cannot modify the signed message because doing so invalidates the mathematical signature created by the private key [4].

Proper configuration of the relying party identifier prevents authentication failures across complex web architectures. Identity architect Deepak Gupta advises organizations to set the relying party identifier to the apex domain, such as example.com, so that passkeys function across subdomains like app.example.com [9]. In academic security testing, Catalano, Chezzi, Barletta, and Tommasi found that while WebAuthn stops proxy phishing, pairing reflected cross-site scripting with browser-in-the-middle techniques requires web developers to sanitize all application inputs [1].

Managing Discoverable Credentials on Secure Hardware

The WebAuthn specification supports two credential structures: non-discoverable credentials and discoverable credentials. Non-discoverable credentials require the website to identify the user and pass their credential ID before the authenticator can sign [6]. By contrast, discoverable credentials store the user ID and domain directly on the authenticator [10]. This design allows users to log in without entering a username [7].

Passkeys exist in two primary forms: hardware-bound credentials and synchronized passkeys. Hardware-bound keys live on dedicated physical tokens like YubiKeys and connect to computers over USB, Near Field Communication, or Bluetooth Low Energy using the CTAP2 protocol. Because the private key cannot be exported or copied, physical security keys provide high security assurance for corporate administrators and sensitive infrastructure [5]. In maritime computing research, Wu and Ku developed a distributed WebAuthn model for shipboard networks, showing that hardware-bound credentials maintain reliable authentication across intermittent, high-latency satellite connections [2]. Device-bound tokens keep private keys safe even when host computers suffer operating system compromises [15]. Physical tokens remain standard in high-security facilities.

Synchronized passkeys solve the problem of lost devices by backing up cryptographic keys through end-to-end encrypted cloud ecosystems such as Apple iCloud Keychain, Google Password Manager, or Bitwarden. The private key material synchronizes between a user’s verified devices without allowing cloud operators to inspect the secrets [7]. When a person buys a replacement phone, their passkeys restore automatically, preventing the lockouts that previously hindered hardware security key adoption [5].

Platform Authenticators and Hardware Security Keys

Consumer devices now package cryptographic authenticators into their default operating systems. These platform authenticators include Windows Hello on personal computers, Touch ID and Face ID on Apple platforms, and biometric screen locks on Android devices [10]. When an online service requests authentication, the operating system manages the verification dialogue directly, preventing malicious browser extensions from capturing user credentials or tampering with cryptographic assertions [6]. Users confirm logins with the same biometric gesture they use to access their mobile screens [12]. That familiarity makes cryptographic authentication feel like unlocking a phone rather than navigating complex security protocols. Hardware security modules protect the key data beneath the operating system.

Enterprise provider Ping Identity notes that WebAuthn delivers two-factor security in one step. The physical device provides something you have, while biometric sensors provide something you are [8]. Biometric data stays on the device and never crosses the network [15]. The sensor only releases a signature after verifying the fingerprint or face locally [8].

Broad device compatibility gives websites an established base for passkey rollouts. Authentication vendor Descope estimates that approximately 95% of consumer devices in circulation support WebAuthn standards [4]. Software engineers can test browser compatibility by checking for the window.PublicKeyCredential interface in JavaScript before serving registration prompts. Demonstration tools such as Cisco Duo’s webauthn.io portal help developers test both platform and roaming authenticators before launching code into production [10].

Deploying WebAuthn Credentials Across Organizations

User interface design influences whether people adopt passkeys or continue using passwords. Identity specialist Deepak Gupta notes that conditional UI serves as the primary adoption tool, increasing user enrollment five to ten times compared to manual buttons. Browsers surface saved passkeys directly inside autofill dropdown menus, allowing people to sign in with a single tap [9].

Enterprise deployments show how passkeys scale across consumer and workforce applications. Google introduced passkeys in May 2023 and set them as the default option for personal accounts in October 2023, recording over one billion logins across more than 400 million accounts within twelve months [5]. Amazon added passkeys for retail shoppers, reporting that over 175 million customers used passkeys to sign in six times faster than with passwords. Microsoft recorded a 987% increase in passkey use, noting that passkey sign-ins finish three times faster than standard passwords and eight times faster than passwords paired with traditional multi-factor authentication. Cloud insurer Branch Insurance achieved a 50% drop in login help tickets after deploying passkeys for 12,000 independent agents [4].

The W3C Web Authentication Working Group continues to advance standard capabilities, publishing Candidate Recommendation Snapshots for WebAuthn Level 3 during 2026. Level 3 introduces the Pseudo-Random Function extension, which lets passkeys derive encryption keys to protect client-side vaults. Another addition, Related Origin Requests, allows a single passkey to authenticate across associated company domains [15]. These technical improvements solidify passkeys as the foundation for modern web security [12].

1. ^{ACADEMIC JOURNAL} Catalano, C., Chezzi, A., Barletta, V. S., & Tommasi, F. (2025). Defeating FIDO2/CTAP2/WebAuthn using browser in the middle and reflected cross site scripting. Journal of Computer Virology and Hacking Techniques, 21(1). [Article Link]
2. ^{ACADEMIC JOURNAL} Wu, Z., & Ku, C. (2026). A deployment-aware multi-node FIDO2/WebAuthn authentication architecture for maritime information systems. Journal of King Saud University – Computer and Information Sciences, 38(7). [Article Link]
3. ^{ONLINE NEWS} Shankland, S. (2018). Firefox wants to help you move into the post-password future, starting now. CNET. [Article Link]
4. ^WEBSITE Shapira, G. (2022). WebAuthn: How it Works & Example Flows. Descope. [Article Link]
5. ^WEBSITE SentinelOne. (2026). What Is WebAuthn? Definition, Examples & Best Practices. SentinelOne. [Article Link]
6. ^WEBSITE MDN Web Docs. (2026). Web Authentication API. MDN Web Docs, Mozilla. [Article Link]
7. ^WEBSITE Martinuke0. (2026). Inside WebAuthn: How Passkeys Really Work Under the Hood. Martinuke0’s Blog. [Article Link]
8. ^WEBSITE Ping Identity. (2019). What is WebAuthn and How Does it Work? Ping Identity. [Article Link]
9. ^WEBSITE Gupta, D. (2026). WebAuthn Explained: How Passkeys Work Under the Hood. CIAM Compass. [Article Link]
10. ^WEBSITE Cisco Duo. (2026). What is WebAuthn? Web Authentication API standard explained. Cisco Duo. [Article Link]
11. ^WEBSITE passkeys.io. (2024). Passkeys: How Do They Work? passkeys.io. [Article Link]
12. ^REPORT World Wide Web Consortium. (2019). Web Authentication: An API for accessing Public Key Credentials Level 1. W3C Recommendation. [Article Link]
13. ^BOOK Langley, A. (2024). A Tour of WebAuthn. imperialviolet.org. [Article Link]
14. ^{PRESS RELEASE} World Wide Web Consortium. (2019). W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins. W3C. [Article Link]
15. ^WEBSITE Wikipedia contributors. (2026). WebAuthn. Wikipedia, The Free Encyclopedia. [Article Link]