Introduction to passkeys
Passkeys are a secure, cryptographic way to authenticate a user without a password, providing better security, safety and ease of use than passwords themselves. More and more websites are adapting this
How passkeys work
Passkeys utilize cryptographic technology in development for more than ten years. The
Passkeys are an asymmetric key pair
Each passkey is a pair of two related asymmetric cryptographic keys, which are very long, random strings of characters. While they differ from each other, they do have a special relationship - one can decrypt messages that have been encrypted by the other. This feature can be used to verify a user and authenticate them.
The key pair is made up of a private key that’s kept securely on your device, inside a password manager supporting passkeys (also called a passkey provider), and a public key that’s stored on the website you are logging into. Your private key is secure and never leaves your device, and the password manager keeps it locked by biometrics, PIN, or a password. The public key, on the other hand, could be shared with the world, such as in the case of a website data breach, and your security wouldn't be compromised so long as the private key stays safe.
Here’s a
To sign into a passkey-enabled website, that site will send a login challenge - a really large random number - and then your secret key will use cryptography to “sign” the challenge with a response to the number. The website checks that signature with its public key to verify that the signature is authentic. Once confirmed, the website can confidently grant access to your account.
Passkeys in Bitwarden
Bitwarden supports creating and storing passkeys in the
If you’d like to get started today,