A passkey is a sign-in credential based on public key cryptography that a person unlocks with the same method they use to unlock their device, such as a fingerprint, face, or PIN. The FIDO Alliance defines a passkey as “an authentication credential based on FIDO standards.” A passkey proves that the person signing in controls the account; it does not prove who they are in law or whether they may vote.
Definition
The FIDO Alliance describes a passkey as “an authentication credential based on FIDO standards, that can be stored on your phone or computer” and says passkeys “replace passwords with cryptographic key pairs for phishing-resistant sign-in security”.1 The underlying web standard is the W3C’s Web Authentication specification, which “defines an API enabling the creation and use of strong, attested, scoped, public key-based credentials”.2 In that specification, a discoverable credential is “a public key credential source that is discoverable and usable in authentication ceremonies,” and “passkey” is listed as an alternate name.2 The specification reached W3C Recommendation status in Level 3 dated 25 August 2026.2
The key idea is a split of keys. FIDO’s Passkey Central explains that “the online service only has the public key,” while “the user’s device or security key creates and securely retains the private key”.4 “A unique passkey is created for each domain and account,” and “by design, a passkey is only presented to the site it was registered with”,4 so a look-alike site has nothing to capture.
Origin and history
Passkeys are the consumer form of FIDO authentication. Two kinds exist. The FIDO Alliance says passkeys “can be securely synced across a user’s devices, or bound to a particular device (device-bound passkeys),” and that “passkey syncing is end-to-end encrypted”.1 Synced passkeys are stored with a passkey provider so they survive the loss of one phone; device-bound passkeys “never leave a single device”.1
NIST’s current authentication guideline treats these differently. It calls credentials whose keys can be managed across devices “syncable authenticators,” permits exportable keys at AAL2, and states that “syncable authenticators SHALL NOT be used at AAL3,” which requires “a cryptographic authenticator with a non-exportable private key”.3
How passkeys are used and measured
A passkey sign-in has three steps: the service sends a challenge, the person unlocks their authenticator (for example, with a fingerprint), and the authenticator answers the challenge with the private key for that site. FIDO states that information about the local unlock method “never leaves the local device”,4 so the service learns that the key holder approved the sign-in, not the fingerprint itself.
The security property that matters most is phishing resistance, which NIST defines as preventing disclosure of authentication secrets to an impostor “without relying on the vigilance of the claimant”.3 FIDO states that “passkeys are phishing resistant and secure by design”.1 Adoption is growing but uneven; a 2024 survey commissioned by the FIDO Alliance found “53% of people reported enabling passkeys on at least one of their accounts”.1 That figure comes from an industry body promoting the standard and is reported here as its claim.
Common confusions and neighboring terms
- Passkey vs. password. A password is a shared secret that can be typed into a fake site. A passkey’s private key is never sent to the service.
- Passkey vs. biometric. The biometric only unlocks the device’s key. The service does not receive or store it.
- Passkey vs. identity proofing. A passkey can be created by anyone for any account; nothing about it ties the account to a real, verified person.
- Passkey vs. eligibility. A passkey cannot show citizenship, age, or residence.
- Passkey vs. authentication. A passkey is one kind of authenticator; authentication is the process it is used in.
How My Vote Forward uses the term
My Vote Forward’s demo uses passkeys, with recovery codes, for sign-in, so that demo accounts do not depend on passwords or email links. The framework is explicit that a passkey authenticates an account and does not establish identity or eligibility. The device and recovery considerations are discussed in Hardware, and the identity limits in Identity and registration. Standards are cited for definitions; neither FIDO, W3C, nor NIST has approved this project.
What My Vote Forward can and cannot do here
My Vote Forward can offer phishing-resistant sign-in on its demo and explain what it protects. It cannot stop one person from creating several accounts with several passkeys. It cannot help a person who loses every device and every recovery code, beyond what the recovery design allows. It cannot verify who holds a passkey.
Unresolved questions
- Is account recovery the weak point of passkey systems, and how should a civic system design it without email or phone numbers?
- Should a public system accept synced passkeys, which depend on large platform providers, or require device-bound keys, which are harder to keep?
- How should people without a compatible device be included?
Sources
- FIDO Alliance, “Passkeys.” fidoalliance.org/passkeys
- W3C, “Web Authentication: An API for accessing Public Key Credentials, Level 3,” W3C Recommendation, 25 August 2026. w3.org/TR/webauthn-3
- NIST, SP 800-63B-4, Authentication and Authenticator Management. pages.nist.gov/800-63-4/sp800-63b.html
- FIDO Alliance, Passkey Central, “How passkeys work.” passkeycentral.org/…
