Glossary · simply explained

Passkeys & FIDO2

Passkeys replace passwords with cryptography: phishing-resistant, no secrets on servers — the new login standard.

Passkeys are the passwordless login standard based on FIDO2/WebAuthn: instead of a password, the device holds a cryptographic key pair. The private key never leaves the device; the service only knows the public part — there is no secret left to steal or phish.

The decisive advance is phishing resistance: a passkey only works for exactly the domain it was created for. Fake login pages come to nothing — the most common attack type loses its lever.

How do passkeys work?

On registration the device generates a key pair per service; the public key is stored with the service. To sign in, the device signs a challenge from the service — released via fingerprint, face or device PIN. Biometrics stay local; only the signature is transmitted.

Synchronised passkeys travel encrypted to further devices via account ecosystems (Apple, Google, password managers); device-bound passkeys on hardware tokens such as YubiKeys deliberately stay on one piece of hardware — the stricter variant for high protection needs.

Why companies are switching

  • Phishing-resistant by design: no secret users could give away.
  • No more password databases that can be stolen and cracked.
  • Faster login, less helpdesk effort for resets.
  • Combinable with SSO and conditional access for a consistent Zero Trust login.

Frequently asked questions about Passkeys & FIDO2

Are passkeys more secure than password plus MFA?

Yes — classic MFA codes can be phished or coaxed via fatigue attacks. Passkeys are bound to the real domain and reveal nothing an attacker could reuse. FIDO2 is therefore considered phishing-resistant MFA of the strongest class.

What happens if the device is lost?

Synchronised passkeys are available or recoverable on other devices via the account ecosystem. For device-bound tokens: register a second key and define secure recovery paths — as with any physical key.

How do FIDO2, WebAuthn and passkey differ?

FIDO2 is the standards package, WebAuthn its browser interface, CTAP the protocol to external tokens — and passkey the user-friendly name for the credentials built on top, usually synchronised. In practice it all means the same login method today.

How does a company introduce passkeys?

Most effectively via the identity provider: enable passkeys as a login method, combine with SSO and roll out with priority to exposed groups — administrators, executives, finance. Passwords remain as a fallback for the transition and are devalued step by step.

Do passkeys work for internal applications too?

Yes — as soon as login runs via a central IdP or a ZTNA platform, internal and older applications benefit as well: the phishing-resistant login happens at the access point, nothing changes for the application behind it.

More terms

Patch management

Patch management closes vulnerabilities before attackers exploit them — prioritised, tested and demonstrable.

PCI DSS

PCI DSS is the credit card industry's security standard for all companies that store, process, or transmit cardholder data. This article explains the core requirements, shows how network segmentation considerably reduces the audit scope, and distinguishes the standard from the GDPR.

Wondering how this looks in your own network? Talk to KAEMI: we plan, build and manage the right solution with you.