Web Authentication with WebAuthn and Passkeys
WebAuthn and passkeys replace passwords with public-key credentials that are, by design, phishing-resistant. Instead of a shared secret you type, your device holds a private key and proves possession of it through a cryptographic challenge. There is nothing to leak, reuse, or hand to a fake site — which addresses the root cause behind most account takeover.
How does WebAuthn work?#
It is asymmetric cryptography applied to login:
- Registration — your device (an authenticator) generates a key pair for the site. The public key is registered with the server; the private key never leaves the device.
- Authentication — the server sends a random challenge. The device signs it with the private key, gated by a local check (biometric or PIN).
- Verification — the server verifies the signature with the stored public key.
Because the private key stays on the device and only signs challenges, the server never holds a secret worth stealing — a breached credential database yields only public keys.
Why does this defeat phishing?#
Because the credential is bound to the site’s origin. The browser will only use a passkey with the exact origin it was created for:
| Password / OTP | Passkey | |
|---|---|---|
| Something to type | Yes — phishable | No |
| Works on look-alike domain | Yes | No — origin-bound |
| Server stores a secret | Yes | No — only a public key |
| Reusable across sites | Often (bad) | No — unique per site |
A phishing page at examp1e.com simply cannot invoke the passkey registered for example.com.
Passkeys are the strongest form of MFA and the future of authentication. More at the Web Security hub.
Frequently asked questions#
What is a passkey?
A passkey is a public-key credential that replaces a password. Your device generates a key pair, keeps the private key secure (in hardware or a synced keychain), and registers the public key with the site. Logging in proves possession of the private key via a cryptographic challenge — nothing secret is shared, so there is nothing to phish or leak.
Why are passkeys phishing-resistant?
Because the credential is cryptographically bound to the site’s origin. The browser only offers the passkey to the exact site it was created for, so a look-alike phishing domain gets nothing — there is no code to type and no secret to hand over. This origin binding is what passwords and one-time codes lack.