Cybersecurity essentials · Lesson 6 of 7
Sign in with a passkey
A passkey lets you prove control of a sign-in credential without typing a shared password into a webpage. Learn what that changes, and what still needs protection.
A challenge, not a shared password
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- A fresh challenge
The known service starts a sign-in challenge. This is a simplified flow after registration.
- Approve locally
The browser checks the service context. You unlock use of the credential on your device.
- Sign the challenge
The authenticator uses the private key to produce a response. It does not send the private key to the website.
- Verify the response
The service checks the response with the registered public key and other required checks. Recovery and device protections still matter.
What stays private?
Compare the parts before making a security decision.
- Challenge
A fresh sign-in request from the service.
- Private key
Used by the authenticator, not sent to the website.
- Signed response
Checked by the service with the registered public key.
Read the visualWhat does the website normally receive during a passkey sign-in?
The service verifies the signed response. The private key and local unlock information are not sent to it.
Prove possession
The service sends a challenge. Your authenticator signs it with a private key; the service checks the response with the registered public key. The private key is not sent to the website.
Check the site boundary
The browser and authenticator bind use of the credential to the service. A lookalike site cannot simply collect and replay the real site’s passkey as it could a typed password.
Plan recovery
Some passkeys sync through a provider; others stay on a device or security key. Protect the device, provider account, and recovery methods. Phishing resistance does not make a compromised device safe.
Put it in context
A fictional training portal supports a passkey. You open its known address and approve a sign-in using the device prompt. A message later asks you to type the passkey into another website. That is not how this sign-in works; verify the request independently.
A passkey proves possession for a particular service. Recovery and device security still matter.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.