The Evidence for Passkeys: How Public-Key Cryptography is Finally Killing the Password

For the entirety of the internet's history, digital identity has relied on a shared secret: a password that both the user and the server must know. This architecture created a permanent vulnerability. If a server is breached, or if a user is tricked into typing their secret into a fake website, the credential is compromised. By 2026, the technology industry has largely agreed that patching this system with SMS codes and authenticator apps is no longer sufficient. The solution, now rolling out as the default across major platforms, is the passkey.[1][8]

The central claim behind passkeys is that they are "phishing-resistant." In cybersecurity, this is a specific, high-bar technical definition. It means that even if a user is completely fooled by a perfect replica of a banking website and willingly attempts to log in, the authentication will fail, and the attacker will capture nothing of value. To understand how this is possible, one must look at the underlying mechanism: public-key cryptography.[2][6]

When a user creates a passkey for a website, their device—whether an iPhone, an Android phone, or a Windows PC—generates a unique mathematical keypair. This consists of a public key and a private key. The public key is sent to the website's server and stored in its database. The private key never leaves the user's device. It is locked inside a specialized hardware component called a Secure Enclave or Trusted Execution Environment.[3][5]

During a login attempt, the website sends a cryptographic "challenge" to the user's device. The device asks the user to authorize the action, usually via a biometric check like Face ID or a fingerprint. Once authorized, the device uses the private key to mathematically sign the challenge and sends the signature back to the server. The server uses the public key to verify the signature. Because the server never holds the private key, a data breach at the company yields nothing that hackers can use to log in.[1][3]

The mechanism that stops phishing relies on how the browser interacts with the WebAuthn standard. When a website requests a signature, the browser strictly binds that request to the exact domain name in the address bar. If a user is tricked into visiting "chase-login-secure.com" instead of "chase.com," the browser recognizes the mismatch. It will simply refuse to use the passkey registered for the legitimate domain. The user cannot accidentally give away their credential because they never actually know the credential in the first place.[3][6]

Evidence of this system's efficacy is overwhelming. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) have both updated their guidelines to mandate phishing-resistant multi-factor authentication for critical infrastructure, explicitly citing FIDO2 and WebAuthn standards as the gold standard. In real-world deployments, organizations that have fully transitioned to hardware-bound or synced passkeys report a near-zero success rate for credential-harvesting attacks.[2][6]

Despite the cryptographic elegance, early iterations of this technology struggled with usability. If a private key was permanently locked to a single physical device, losing that device meant losing access to all accounts. The breakthrough that enabled mainstream consumer adoption was the introduction of "synced passkeys" by Apple, Google, and Microsoft. By integrating passkeys into native cloud credential managers, a passkey created on an iPhone automatically becomes available on the user's iPad and Mac.[4][5]

This syncing mechanism introduces a necessary security trade-off. Security purists historically demanded that cryptographic keys remain "device-bound," meaning they can never be copied or transferred. Synced passkeys, by definition, move between devices via the cloud. This shifts the attack surface from the individual website to the user's underlying cloud account (e.g., their Apple ID or Google Account).[7][8]

To mitigate this risk, platform providers employ end-to-end encryption for passkey syncing. Apple and Google have architected their systems so that the passkeys are encrypted using keys derived from the user's device passcode. The providers themselves cannot read the private keys as they pass through their servers. Academic evaluations of these syncing protocols confirm that while the theoretical attack surface is larger than a standalone hardware key, the practical security posture remains exponentially stronger than any password-based system.[4][5][7]

A remaining area of friction is cross-ecosystem authentication. What happens when an iPhone user attempts to log into a smart TV or a Windows laptop where their iCloud Keychain is not present? The FIDO Alliance anticipated this with a protocol called Cross-Device Authentication (CDA).[1][3]

CDA allows a user to display a QR code on the new device and scan it with their phone. The two devices establish a secure local connection using Bluetooth to verify physical proximity—ensuring the user isn't scanning a QR code sent by a remote attacker. The phone then signs the login challenge on behalf of the new device. While cryptographically sound, usability studies show that users still find this handoff slightly confusing compared to the seamless native biometric prompts they experience on their primary devices.[3][7]

Enterprise IT departments face a different set of challenges. While consumer platforms prioritize recovery and convenience, enterprises often require strict control over credential lifecycles. Many organizations are opting for device-bound passkeys managed through mobile device management (MDM) profiles, ensuring that when an employee leaves, their access is cryptographically revoked without relying on consumer cloud syncing.[2][8]

The final frontier for the passwordless web is account recovery. If a user loses all their devices and forgets their cloud account password, how do they regain access to their digital life? Currently, most services rely on fallback methods—such as emailing a magic link or sending an SMS code—to bootstrap a new passkey. This temporarily downgrades the security of the account to the security of the user's email inbox.[7][8]

To address this, the industry is moving toward delegated recovery networks and social recovery protocols, where trusted contacts can cryptographically vouch for a user's identity. Until these systems mature, the transition period will require users to maintain strong security hygiene on their primary email accounts, which act as the ultimate skeleton key.[2][7]

Despite these edge cases, the empirical evidence is clear. Passkeys eliminate the root cause of over 80% of data breaches: stolen or reused passwords. They reduce the time it takes to log in by more than half, and they remove the cognitive burden of password management. As the underlying WebAuthn standard continues to evolve, the era of the shared secret is definitively coming to an end.[1][4][8]