A passkey is a FIDO2-based passwordless authentication credential that replaces passwords. It uses biometrics (fingerprint, face recognition) or hardware security keys to sign in to websites and apps. Passkeys are phishing-resistant, more secure than passwords, and provide a faster sign-in experience.

How do passkeys work?

Passkeys work in three steps: (1) The user registers a device by authenticating with biometrics or a security key. (2) A cryptographic key pair is created—the private key stays on the device, the public key goes to the server. (3) On subsequent logins, the user authenticates with biometrics to unlock the private key, which signs a challenge from the server.

Are passkeys more secure than passwords?

Yes. Passkeys are bound to the legitimate website domain, making them inherently resistant to phishing. They use public-key cryptography instead of shared secrets, so server breaches don't expose user credentials. Biometric authentication adds an additional layer of security.

Which companies support passkeys?

Major companies supporting passkeys include Google, Apple, Microsoft, Amazon, PayPal, GitHub, and many more. Apple, Google, and NTT have been key contributors to the FIDO2 standard. The FIDO2 market is projected to grow from $18.82 billion in 2024 to $60.34 billion in 2032.

Passkey essentials

Everything teams need to understand Passkeys

Share the fundamentals with product, security, and CX partners using this at-a-glance passkey briefing powered by amiPro research.

FIDO2 ready Phishing resistant Device agnostic

See benefits Contact

Various passkey authentication devices including smartphones, laptops, and security keys

How Passkeys Work: Step by Step

Registration: The user registers a passkey by authenticating with biometrics (fingerprint or face recognition) or a hardware security key on their device.
Key pair creation: A cryptographic key pair is generated. The private key stays securely on the user device; the public key is sent to the website server.
Authentication: On subsequent logins, the user authenticates with biometrics to unlock the private key, which signs a cryptographic challenge from the server.
Verification: The server verifies the signature using the public key and grants access — no password ever transmitted.

Passkey Benefits for Businesses

99.9% phishing reduction: Passkeys are bound to the legitimate website domain, making phishing attacks ineffective.
203% ROI over 3 years: Reduced security incidents, lower support costs, and improved conversion rates deliver measurable returns.
75% fewer support tickets: Eliminating password resets dramatically reduces help desk burden by year three.
Faster sign-ins: Biometric authentication is quicker than typing passwords, reducing login abandonment.

amiPro Passkey Hub provides FIDO2-certified infrastructure with open-source SDKs for JavaScript, iOS, and Android.

Everything teams need to understand Passkeys

How Passkeys Work: Step by Step

Passkey Benefits for Businesses

define

define

define

define