A passkey is a FIDO2 and WebAuthn credential that replaces the password with public-key cryptography. The private key never leaves the device, the credential is bound to the domain, and a phishing page on a different domain cannot use it. CISA calls FIDO and WebAuthn the only widely available phishing-resistant authentication. Okta's research found zero successful account takeovers among more than 6,000 social engineering incidents where passkeys were enforced. But a passkey proves a device, not a human, and a bot running on a real device can enroll a passkey as easily as a person can.
What passkeys actually stop
A passkey is a FIDO2 and WebAuthn credential. The device generates a key pair, keeps the private key on the device, and sends the public key to the server. When the user signs in, the server sends a challenge, the device signs it with the private key, and the server verifies the signature. The private key never leaves the device, the credential is bound to the domain, and a phishing page on a different domain cannot use it, because the domain does not match.
The numbers behind the claim are strong. CISA calls FIDO and WebAuthn the only widely available phishing-resistant authentication, which is the highest endorsement a US agency gives a consumer technology. Okta's research found zero successful account takeovers among more than 6,000 social engineering incidents where passkeys were enforced. FIDO's 2024 survey found 53 percent of respondents had enabled passkeys on at least one account. The adoption is real, and the phishing protection is real.
Related reading on this site: Home and Device Fingerprinting: What It Catches and What It Misses cover the neighbouring problems in more depth.
The bot problem passkeys do not solve
A passkey proves a device, not a human. That distinction is the whole problem for signup fraud. A bot running on a real device, a device farm phone, a compromised TV box, or a cloud phone, can enroll a passkey as easily as a person can, because the enrollment is a cryptographic operation, not a test of humanity. The device generates the key pair, the server stores the public key, and the account is created. The bot has a passkey, and the passkey is genuine.
The research on stolen credentials shows why passkeys matter anyway. FIDO-cited research puts the share of hacking-related breaches involving stolen credentials at 77 percent, which is the problem passkeys were built to solve. But the signup fraud problem is different: the attacker does not need to steal a credential, because the signup flow gives them one for free. A passkey at signup stops the credential theft. It does not stop the fake account.
What to pair with passkeys at signup
Passkeys belong in the authentication stack, not in the signup defense stack. At signup, the checks that matter are the ones that test humanity and intent: a CAPTCHA or a proof-of-work challenge, a device fingerprint that looks for the farm's uniformity, an IP reputation check that catches the residential proxy, and a velocity limit that slows the burst. The passkey can be offered at signup as an option, and it should be, because it protects the account from takeover later. But it should not be the signup defense, because the bot can enroll it.
The honest framing is that passkeys solve the account takeover problem and leave the fake signup problem untouched. A store that replaces passwords with passkeys and expects the fake signups to stop will be disappointed, and the disappointment will look like a passkey failure when it is actually a category error. Pair the passkey with a signup defense that tests the human, and both problems get solved by the tool built for each.
Frequently asked questions
What is a passkey?
A FIDO2 and WebAuthn credential that replaces the password with public-key cryptography. The device keeps the private key, the server stores the public key, and the credential is bound to the domain, so a phishing page on a different domain cannot use it.
Do passkeys stop phishing?
Yes. CISA calls FIDO and WebAuthn the only widely available phishing-resistant authentication, and Okta found zero successful account takeovers among more than 6,000 social engineering incidents where passkeys were enforced.
Do passkeys stop fake signups?
No. A passkey proves a device, not a human, and a bot running on a real device can enroll a passkey as easily as a person can. The signup defense needs checks that test humanity: a CAPTCHA, a device fingerprint, an IP reputation check, and a velocity limit.
How widely adopted are passkeys?
FIDO's 2024 survey found 53 percent of respondents had enabled passkeys on at least one account. The adoption is real, and the phishing protection is real, but the signup fraud problem needs a different tool.