What Are Passkeys, WebAuthn and FIDO2?

Passkeys are credentials based on FIDO2 and WebAuthn. Instead of sharing a password, an authenticator creates a key pair. The private key remains on a device, hardware token or protected synchronization service; the website stores the public key. Login signs a server challenge and is bound to the real domain.

FIDO2, WebAuthn and CTAP

Simplified login flow

options = {
  challenge: randomBytes(32),
  rpId: "example.test",
  allowCredentials: user.registeredCredentialIds,
  userVerification: "required"
}

verify(assertion, {
  challenge: storedChallenge,
  origin: "https://example.test",
  rpId: "example.test",
  publicKey: credential.publicKey,
  counter: credential.signCount
})

The server validates challenge, origin, RP ID, signature, credential ID and user verification. Challenges are single-use and short-lived. Use a mature library for binary formats and cryptography.

Why are passkeys phishing-resistant?

The authenticator binds signatures to the Relying Party ID, so a lookalike domain cannot request a valid signature for the genuine site. There is no reusable password for credential stuffing. Recovery and support social engineering still matter.

Important design questions

• - Support multiple passkeys/devices and clear management.
• - Make recovery at least as strong as normal login.
• - Protect add/remove with reauthentication, notification and audit logs.
• - Consider device-bound hardware keys and attestation for high-risk accounts.
• - Include sync, privacy, migration and lost devices in threat modeling.

Useful open-source tools

python-fido2 and SimpleWebAuthn provide maintained implementation building blocks. The W3C WebAuthn repository contains the standard and tests. Integration tests for wrong origin/RP ID, replayed challenge, unknown credential and missing verification matter more than a generic scanner.