The password has been the weakest link in digital security for decades: it gets guessed, leaked, reused and impersonated. Against that hole come passkeys and the WebAuthn standard, which replace the “something you know” with a pair of cryptographic keys that can’t be stolen or transferred. This article walks through the machinery behind the scenes, step by step and without the hype.
The core problem: a secret that travels
When you type your password, that piece of data travels from your browser to the server. Even if it’s encrypted by TLS in transit, a copy exists at the destination: the server has to store it (usually as a salted hash) to compare against later. That copy is the target: a database breach exposes the material used to impersonate you. Password authentication turns the server itself into a single point of failure.
Everything changes with an asymmetric key
WebAuthn flips the logic using asymmetric cryptography, the same family of algorithms behind RSA and elliptic-curve crypto (ECDSA). Instead of a shared secret, every device generates two pieces: a private key that never leaves the hardware, and a public key that is handed to the service. The crucial fact is the underlying math: what one key encrypts, only its pair can decrypt, and the private key can’t be derived from the public one.
When you register on a site with WebAuthn, your authenticator (the phone’s chip, a USB key, or your system’s key manager) generates a key pair specific to that service and hands back a credential: the ID, the public key, and attestation metadata. The server stores the public key. The private key stays locked inside the device, typically within a secure element or secure enclave: an isolated coprocessor that even the operating system can’t fully read.
The challenge that proves “it’s you”
When you sign back in, the server doesn’t ask for anything that travels: it sends you a challenge (a random value) and your device signs it with the private key. The server verifies the signature with the stored public key. Because the challenge changes on every access, a captured one is useless for replay: it’s replay-proof.
To sign, the system needs user verification: your fingerprint, your face, or your PIN. It’s important to understand that the biometric isn’t the secret — it’s just the key that “unlocks” the use of the private key. The cryptographic secret remains the private key, which never leaves the chip. Hence its resistance to phishing: because the signature is bound to the exact domain (the RP ID, relying party ID) for which the key was generated, a fake page on another domain simply can’t obtain a valid signature.
How does the browser talk to your key?
The protocol that carries it all is called CTAP2 (Client To Authenticator Protocol), and the combination of WebAuthn plus CTAP2 goes by the name FIDO2. The browser acts as an intermediary: your web code uses the navigator.credentials.create() API (to register) and navigator.credentials.get() (to sign in), and the browser finds your authenticator over USB, Bluetooth/NFC, or the system’s internal channel. The authenticator reports its presence to the site through a PublicKeyCredential object that carries, besides the signature, the extensions and the attestation proving which vendor produced it.
Resident keys and sync: passkeys
Originally, a credential from outside the browser only worked while the hardware key was plugged in; you had to copy the credential ID around. Resident keys (or discoverable credentials) solve this by storing the full credential inside the authenticator, so the server doesn’t even need to send you the ID. On that foundation, Apple, Google and Microsoft built the passkey concept: the private key lives in the system’s keychain and syncs between your devices through their cloud, encrypted end to end.
That convenience has a design trade-off: by syncing the private key, it no longer lives only on your local hardware but “floats” in the vendor’s cloud vault. Recovery mechanisms and cloud enclaves soften the risk, but the piece that leaves the device is no longer exclusively yours. That’s why the most purist defenders still prefer physical hardware keys that never export the key.
Who’s behind it and what’s next
WebAuthn is a W3C and FIDO Alliance standard, already supported by all major browsers. Adoption is scaling: more and more financial services, platforms and enterprise managers offer it as the preferred option. In the short term you’ll live with both worlds, but the direction is clear: the “secret that travels” is giving way to the local signature that proves ownership. The password won’t vanish overnight, but its reign does have an announced expiry date.
