Passkeys
What Are Passkeys? Definition and How They Work
Definition
Passkeys are cryptographic authentication credentials that replace passwords and SMS one-time codes with a public-private key pair bound to the user's device and unlocked by a local biometric or PIN. Implementing the FIDO2/WebAuthn standard, passkeys provide phishing-resistant, passwordless authentication that cannot be stolen through credential phishing, data breaches, or SIM-swapping attacks.
How it works
When a user registers a passkey, the device generates a unique public-private key pair. For device-bound passkeys, the private key is stored in the device's hardware, Secure Enclave (iPhone), StrongBox/TEE (Android), or TPM (Windows), and never leaves the device. The public key is registered with the service. No shared secret, no password, no OTP seed, is stored on the server.
Authentication works through challenge-response: the server sends a random challenge; the device signs it with the private key; the server verifies the signature against the registered public key. The private key is accessed only after the user completes local authentication, Face ID, fingerprint, or device PIN. The biometric never leaves the device.
Passkeys are phishing-resistant because the credential is bound to the specific origin (domain) at which it was registered. A phishing site cannot use a passkey registered for the legitimate site, the credential will not respond to a challenge from a different origin.
Multi-device passkeys sync the credential securely across devices via end-to-end encrypted cloud backup through Apple, Google, and Microsoft credential managers, solving the single-device loss problem.
Why it matters
Passwords are the root cause of the majority of account compromise events: credential stuffing, password reuse attacks, phishing, and data breach exploitation all depend on a shared password existing. Passkeys eliminate passwords entirely, removing the credential most attacks are designed to steal.
For payments, passkey adoption has significant implications for 3DS and SCA flows. A passkey authentication satisfies both the 'something you have' (device with private key) and 'something you are' (biometric unlock) SCA factors simultaneously, enabling strong authentication without separate OTP delivery.
Consumer experience improves materially, replacing a password + SMS OTP flow with a Face ID confirmation reduces checkout authentication friction and improves conversion on authenticated payment flows.
With PXP
PXP supports merchants and partners across the payments value chain. To talk through authentication as part of your payment strategy, get in touch with our team.
Frequently asked questions
Are passkeys the same as biometric authentication?
Passkeys use biometrics as the local unlock mechanism but the authentication itself is cryptographic, not biometric. The server verifies a cryptographic signature, not a biometric reading. The biometric never leaves the device, the server has no biometric data to steal.
What is the FIDO2 standard?
FIDO2 is an open authentication standard from the FIDO Alliance and W3C, comprising WebAuthn (browser and platform API) and the CTAP protocol (allowing external devices like security keys). Passkeys are the consumer-facing term for synced FIDO2 credentials. FIDO2 is supported natively by Apple, Google, Microsoft, and all major browsers.
Can passkeys replace 3DS authentication in payments?
Passkeys can form the basis of the 3DS2 challenge where the issuer supports FIDO2 authentication. Mastercard Identity Check and Visa Secure support FIDO-based authentication (including Secure Payment Confirmation) within EMV 3DS as a challenge mechanism. When a consumer authenticates with a passkey during a 3DS challenge, it satisfies SCA, meeting both the 'something you have' (device) and 'something you are' (biometric) factors simultaneously.
Revolutionize your business with PXP
Take complete control of your commerce and payments with one platform.
Get Started