A passkey is a key pair: the private key stays on the user's device or in their password manager, and your server stores only the public key. Nothing to phish, nothing useful to steal from your database. How WebAuthn works, synced versus device-bound passkeys, account recovery, and a rollout that does not lock anyone out.
Passwords fail in two ways: people reuse them, and people type them into fake sites. Passkeys, built on the W3C WebAuthn standard and FIDO2, fix both. The browser only uses a passkey on the site it was created for, so a look-alike domain gets nothing.
At registration, the device creates a key pair for your domain and sends you the public key.
At sign-in, your server sends a random challenge; the device signs it after the user unlocks it with a fingerprint, face or PIN.
Your server checks the signature with the stored public key. No shared secret ever crosses the network or sits in your database.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Offer passkeys after sign-in ("sign in faster next time"), not as a forced migration.
Keep a recovery path that is not weaker than the passkey: a verified email with a delay and notification, or support with identity checks. Recovery is where attackers go next.
Let users register several passkeys and see and remove them in settings.
Use your identity provider's passkey support (Cognito, Auth0, Clerk and others offer it) rather than building WebAuthn verification yourself.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
OAuth and OpenID Connect: Which Token Is Which, and the Flow to Use
"Sign in with Google" is OpenID Connect; "let this app read my calendar" is OAuth. Access tokens, refresh tokens and ID tokens do different jobs, and mixing them up causes most auth bugs. The authorization code flow with PKCE, what each token is for, and the mistakes we see in fast-built apps.
Read
Rolling Out Passkeys in 2026: A Practical Guide, Including the Decision You Cannot Undo
Passkeys are now supported by every major platform and can move between password managers. How to roll them out without locking anyone out: enrolment prompts, recovery, the relying-party ID you must choose correctly the first time, and what Cognito, Auth0 and the rest do for you.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.