Passkeys vs Phishing: How They Block Attacks

Passkeys replace passwords with cryptographic key pairs stored on your device, making phishing attacks that trick you into typing credentials on a fake site ineffective. When you sign in with a passkey, your device and the website exchange a unique challenge that only works for that exact site, so a fraudulent lookalike domain cannot receive a valid response. This guide explains the mechanism step by step, what you need to set it up, and how to avoid common pitfalls.

What You’ll Need

A device that supports passkeys: a smartphone (iOS 16+, Android 9+), a laptop or desktop with Windows 10/11, macOS Ventura or later, or a security key (FIDO2).
A browser that supports passkeys: Chrome, Edge, Safari, or Firefox (recent versions).
An online account that offers passkey login (e.g., Google, Microsoft, Apple, PayPal, or any site that shows a “passkey” option).
For cross-device use, Bluetooth enabled on both devices and a QR code scanner (most phones have one built into the camera).

Step-by-Step

Understand the core idea: A passkey is a pair of cryptographic keys—a private key stored on your device (in a secure enclave or password manager) and a public key stored on the website’s server. The private key never leaves your device; it is used only to sign a challenge.
During sign-in, the website sends a challenge: When you click “Sign in with a passkey,” the site generates a random string of data (the challenge) and sends it to your browser.
Your device checks the site’s identity: Your browser verifies that the website’s domain (e.g., example.com) matches the domain that was registered when you created the passkey. This is done via the WebAuthn API, which compares the site’s origin against the stored credential’s relying party ID.
You approve the login: Your device prompts you to authenticate locally—with a fingerprint, face scan, PIN, or by tapping a security key. This proves you are the legitimate user, but the biometric data never leaves your device.
Your device signs the challenge: Using the private key, your device creates a digital signature over the challenge and the site’s origin. This signature is unique to this specific request and this specific domain.
The website verifies the signature: The site receives the signed challenge and uses the public key it stored earlier to verify that the signature is valid and that it was created by the private key matching that public key. If the signature is valid, you are signed in.
Why phishing fails: If you visit a fake site like examp1e.com, that site will send a challenge, but your browser will notice the origin does not match the registered domain. It will refuse to sign the challenge, so the fake site never receives a usable response. Even if the fake site forwards the challenge to the real site, the signature will be tied to the fake origin, and the real site’s server will reject it because the origin in the signature does not match its own domain.

Common Mistakes

Using passkeys on a shared or public computer: If you create a passkey on a shared device, anyone who can unlock that device can sign in as you. Always use a personal device or a security key.
Ignoring the domain check: Some users manually approve a login without noticing the domain shown in the prompt. Always verify that the domain in the prompt is exactly the site you intend to use.
Assuming passkeys are a password replacement everywhere: Not all websites support passkeys yet. You may still need passwords as a fallback, but passkeys reduce the risk of phishing for the sites that do support them.
Storing passkeys in a password manager that doesn’t sync securely: If your password manager’s sync is compromised, your passkeys are exposed. Choose a manager with end-to-end encryption and enable two-factor authentication on the manager itself.
Forgetting to back up your passkeys: If you lose your device without a backup, you may be locked out. Most platforms offer cloud backup (e.g., iCloud Keychain, Google Password Manager) or allow you to export your passkeys.

Tips

Use passkeys for your most sensitive accounts (email, banking, social media) to get the highest protection against phishing.
Enable two-factor authentication (2FA) as an additional layer even when using passkeys, especially for accounts that allow it.
Keep your device’s operating system and browser updated to ensure you have the latest security patches and WebAuthn improvements.
If you use a password manager, choose one that supports passkeys and syncs them securely across your devices.
When signing in on a new device, use the QR code method: scan the code with your phone, confirm the login on your phone, and the new device gets a temporary session—no private key is transferred.

Troubleshooting

I don’t see the passkey option on a site: The site may not support passkeys yet, or your browser/device may be outdated. Update your browser and check the site’s help page for passkey availability.
My passkey isn’t syncing across devices: Ensure you are signed into the same cloud account (Apple ID, Google account, Microsoft account) on all devices and that sync is enabled in your password manager or system settings.
I get an error “This site can’t use your passkey”: This usually means the site’s domain doesn’t match the one registered. Clear your browser cache and try again, or re-register the passkey on the correct domain.
I lost my device and can’t sign in: Use a recovery method provided by the site (e.g., backup codes, email verification) or your cloud backup to restore passkeys on a new device.
Bluetooth pairing fails during cross-device sign-in: Make sure Bluetooth is enabled on both devices and they are within a few feet of each other. Restart both devices and try again.
My security key isn’t recognized: Check that the key supports FIDO2/WebAuthn and that your browser supports it. Try a different USB port or use NFC if available.

Frequently Asked Questions

Can a passkey be phished?

No, because the private key never leaves your device and the signature is tied to the exact domain. A fake site cannot receive a valid signature because your browser will not sign a challenge for an unregistered origin.

What happens if I lose my device?

You can recover your passkeys from a cloud backup (e.g., iCloud Keychain, Google Password Manager) or use recovery codes provided by the website. Without a backup, you may need to go through the site’s account recovery process.

Are passkeys more secure than passwords plus 2FA?

Yes, for phishing resistance. Passwords can be stolen and replayed, and even 2FA codes can be intercepted in real-time phishing attacks. Passkeys eliminate the secret to be stolen.

Can I use passkeys on multiple devices?

Yes, most platforms sync your passkeys across your devices via your cloud account. You can also register the same passkey on multiple devices manually, or use a security key that stores it.

Do passkeys work offline?

Yes, the cryptographic operations happen on your device, so you can sign in without an internet connection. However, the website needs to be reachable to complete the login.

Can I still use passwords if I prefer?

Most sites still offer passwords as a fallback. Passkeys are an additional option, not a forced replacement—yet.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →