Identity · Authentication
Passwordless & Passkeys
Authentication using device bound cryptographic credentials or biometrics instead of a shared secret.
IntermediateUpdated 2026-09-01
Overview
FIDO2 and WebAuthn establish a key pair per relying party. The private key stays in a security key, TPM or secure enclave, and authentication is a signed challenge, nothing reusable is transmitted or stored on the server.
Passkeys extend this with synchronisation across a user's devices, which improves recovery and adoption while introducing governance questions about which sync ecosystems an organisation permits.
Security considerations
- Secure the enrolment and recovery paths, they become the weakest link once passwords are removed.
- Retain a phishing resistant backup method, such as a second security key, for privileged users.