Passkey
A FIDO credential that replaces a password: a key pair bound to one site’s relying-party ID, whose private key stays in an authenticator or is synced by a credential manager and signs each WebAuthn sign-in challenge. Because the signature is tied to the site and no shared secret is sent, passkeys resist phishing and credential stuffing.
- Defined in
- W3C Web Authentication Level 3
Covered in
Guide
Passkeys and MFA: WebAuthn enrollment, sign-in and replacement
Register, verify and replace passkeys with WebAuthn so phishing resistance survives the account’s whole lifecycle, and map passkeys and other MFA methods to the NIST SP 800-63B-4 assurance levels.
Guide
Stop account takeover with the right MFA and login defenses
Rank MFA options by the attacks they stop, implement TOTP and push approvals correctly, and close the login, reset and recovery paths that attackers use instead of breaking the second factor.