This guide is written by the team that builds Casdoor and describes the standards as published (listed under Sources), with notes on how Casdoor implements them as of October 21, 2026. Spotted a mistake? Tell us.
A passkey is a sign-in credential that replaces a password with a cryptographic key pair. The private key stays on the user's device or in their password manager; the website only stores the public key. To sign in, the user unlocks the passkey with their fingerprint, face or device PIN, and the device proves it holds the private key.
Passkeys are built on the WebAuthn standard from the W3C and the FIDO Alliance, and are supported by the major browsers and operating systems.
How a passkey sign-in works
- Registration. The site asks the browser to create a credential. The device generates a key pair for that site, keeps the private key, and sends the public key to the site, which stores it with the user's account.
- Sign-in. The site sends a random challenge. The user unlocks the passkey with biometrics or a PIN, and the device signs the challenge with the private key.
- Verification. The site checks the signature with the stored public key. If it matches, the user is in.
The browser only offers a passkey to the site it was created for, so it won't work on a look-alike phishing domain, and there's no shared secret to leak in a database breach.
Synced and device-bound passkeys
- Synced passkeys are backed up and synced by a credential manager, such as the platform's password manager, so they're available on the user's other devices and survive a lost phone.
- Device-bound passkeys never leave one authenticator, typically a hardware security key. They're common where policy requires the key to stay on approved hardware.
Users can also sign in on a computer with a passkey from their phone, by scanning a QR code.
Passkeys vs passwords
| Password | Passkey | |
|---|---|---|
| What the site stores | A password hash, which attackers try to crack after a breach | A public key, useless to an attacker |
| Phishing | Can be typed into a fake site | Only works on the real site |
| Reuse across sites | Common | Impossible: one key pair per site |
| What the user does | Remember and type it | Unlock with fingerprint, face or PIN |
| Recovery | Reset by email | Synced to other devices, or fall back to another method |
Passkeys and MFA
A passkey sign-in combines something you have (the device or key) with a local check of something you are or know (biometrics or PIN), so it's generally treated as multi-factor and phishing-resistant on its own. Many sites still start by offering passkeys alongside passwords, or as a second factor, and move users over gradually. See What is MFA.
Adding passkeys to your app
Implementing WebAuthn yourself means handling challenges, attestation options, credential storage and account recovery. An identity provider that supports passkeys handles it for every app at once.
Casdoor is an open-source identity provider with WebAuthn sign-in: users register passkeys, built-in authenticators such as fingerprint, face recognition or Windows Hello, or security keys such as a YubiKey, and sign in with them instead of or in addition to a password. Your apps get the user over OpenID Connect, SAML or CAS as usual, without touching WebAuthn. Casdoor also offers TOTP, SMS and email codes, and social login for users who haven't set up a passkey.
Self-host it for free, or run it on Casdoor Cloud from $24/month billed yearly. See also What is an identity provider.
FAQ
Are passkeys the same as WebAuthn? WebAuthn is the browser API and protocol. "Passkey" is the user-facing name for WebAuthn credentials, especially ones that can sync between devices.
What happens if I lose my phone? Synced passkeys are restored from the credential manager on a new device. For device-bound passkeys, sites should offer another sign-in or recovery method.
Do passkeys work on every site? Only on sites that support them. Each site needs WebAuthn on its sign-in page, which is why adding it once at the identity provider helps.
Are biometrics sent to the website? No. The fingerprint or face check happens on the device and only unlocks the private key.
Sources
Product names are trademarks of their respective owners.