Passkeys Explained
Passkeys are a passwordless way to sign in that use a pair of cryptographic keys (a key pair) instead of a
traditional
password. One key is stored securely on your device, while the other is stored by the website.
When you log in, your device uses this key pair to confirm your identity without sharing anything that can be
reused or intercepted. To make sure it is really you, your device may ask for a fingerprint, face scan, or PIN.
Passkeys are used to sign in to services, websites or applications. A very simplistic way to think of a passkey
is a lock that needs two keys to be opened. The site you are trying to sign in to has one key and you have the
other one. Both keys are unique and must be used together. You do not have to remember your passkey because your
device or credential manager (Codebook) stores it for you. This is secure because your device or credential
manager must have authentication (ex. Touch Id or Face Id).
The mechanism is simple:
-
When you create a passkey, your device generates a unique credential and associates it with your account on
that
website.
-
When you sign in, the website sends a request to your device. It then confirms that it is really you and
completes the login without sharing any reusable information.
For the technical explanation of passkeys/FIDO 2, click here.
Creating a Passkey:
Codebook generates two linked
cryptographic keys - a public/private key pair. The private key is stored in Codebook and not in the
website/application. The public key is stored in the website/application. The key pair is specific to the
user/application and is not reused. Both keys are needed to sign in to a website/application.
Sign in with a Passkey stored in Codebook:
-
The website sends a cryptographic challenge to your web browser or device OS.
-
The OS or browser determines whether the website's domain (relying party) already has a registered passkey. If
any are found, the OS prompts the user to select one to authenticate with.
-
Before unlocking the passkey, Codebook requires authentication via biometrics (Face ID, Touch ID)
or master password.
-
Codebook locates the private key corresponding to the website selected by the user earlier and uses it to
mathematically sign the
challenge sent
by the server, and returns the signed assertion associated with the selected credential back to the browser.
The website
then verifies this signature and grants access.
Private Key (The Secret)
-
Stays locked on your personal device.
-
Unlocked only by your face, fingerprint, or screen PIN.
-
Never shared with or seen by the website.
Public Key (The Checker)
-
Sent and saved on the website’s server.
-
Used to verify that your private key signed a login request.
-
Useless to hackers if stolen from a server breach.
-
No Shared Secret: Traditional passwords are secrets shared with a website,
meaning a server hack exposes your data. With passkeys, the website only holds the non-secret checker. So if
the site is hacked, the hacker would not have all of the information needed to sign in to your
account.
-
Phishing Proof: A passkey is tied to a specific web address, so it will not
work if you accidentally visit a fake or scam website.
-
Creating a passkey adds a new, cryptographically secure entry method to your account, but it rarely deletes your existing password automatically.
-
Certain modern services allow you to register using only a passkey or magic link, meaning a password was never
created in the first place.
-
Going Fully "Passwordless": Most major services (like Microsoft and Google) allow you to explicitly remove
your
password from your account settings after adding a passkey. Unless you manually click an option to "Go
Passwordless," your password stays active.
No, there is no mechanism to migrate existing passkeys to Codebook. You'll need to create a new passkey for each
website/application in order to save your passkey in Codebook.